CVE-2026-56336 | Medium | 5.3 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id a… |
CVE-2026-56313 | High | 8.1 | 2026-07-12 | Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delet… |
CVE-2026-56308 | High | 7.3 | 2026-07-12 | Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attac… |
CVE-2026-56281 | Low | 3.8 | 2026-07-12 | Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidat… |
CVE-2026-56252 | Medium | 5.4 | 2026-07-12 | Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook… |
CVE-2026-56241 | High | 8.3 | 2026-07-12 | Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non… |
CVE-2026-56238 | High | 7.5 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to… |
CVE-2026-56303 | High | 7.5 | 2026-07-11 | Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable b… |
CVE-2026-56240 | Medium | 4.3 | 2026-07-11 | Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired… |
CVE-2026-56335 | Medium | 6.5 | 2026-07-10 | Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields thr… |
CVE-2026-56329 | Medium | 6.4 | 2026-07-10 | Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in previ… |
CVE-2026-56312 | Medium | 6.5 | 2026-07-10 | Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is e… |
CVE-2026-56309 | Medium | 5.4 | 2026-07-10 | Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readabl… |
CVE-2026-56305 | High | 8.3 | 2026-07-10 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without re… |
CVE-2026-56279 | High | 7.5 | 2026-07-10 | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended… |
CVE-2026-56298 | Medium | 4.3 | 2026-07-08 | Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can up… |
CVE-2026-56293 | Medium | 5.4 | 2026-07-08 | Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between org… |
CVE-2026-56283 | Medium | 5.4 | 2026-07-08 | Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. At… |
CVE-2026-56250 | High | 7.5 | 2026-07-08 | Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bu… |
CVE-2026-56246 | High | 8.1 | 2026-07-08 | Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its o… |
CVE-2026-56220 | Medium | 6.5 | 2026-07-08 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manif… |
CVE-2026-56217 | Medium | 4.3 | 2026-07-08 | Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles… |
CVE-2026-56334 | Medium | 4.3 | 2026-06-30 | Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder s… |
CVE-2026-56333 | Medium | 4.3 | 2026-06-30 | Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist… |
CVE-2026-56331 | Medium | 5.3 | 2026-06-30 | Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_i… |
CVE-2026-56328 | Medium | 6.5 | 2026-06-30 | Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultC… |
CVE-2026-56327 | Medium | 5.3 | 2026-06-30 | Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to e… |
CVE-2026-56320 | High | 7.1 | 2026-06-30 | Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it match… |
CVE-2026-56318 | Medium | 5.3 | 2026-06-30 | Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error respo… |
CVE-2026-56300 | High | 7.5 | 2026-06-30 | Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and… |
CVE-2026-56286 | High | 8.1 | 2026-06-30 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication… |
CVE-2026-56249 | High | 7.6 | 2026-06-30 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing cha… |
CVE-2026-56247 | High | 8.8 | 2026-06-30 | Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees… |
CVE-2026-56233 | High | 8.3 | 2026-06-30 | Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass uplo… |
CVE-2026-56230 | High | 8.8 | 2026-06-30 | Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header… |
CVE-2026-56224 | Medium | 5.4 | 2026-06-30 | Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confir… |
CVE-2026-56219 | High | 7.5 | 2026-06-30 | Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrie… |
CVE-2026-56338 | Medium | 5.3 | 2026-06-24 | Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication du… |
CVE-2026-56337 | Medium | 5.3 | 2026-06-24 | Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to enumera… |
CVE-2026-56302 | Medium | 6.5 | 2026-06-24 | Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and dele… |
CVE-2026-56257 | High | 7.1 | 2026-06-24 | Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownersh… |
CVE-2026-56256 | High | 7.1 | 2026-06-24 | Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing o… |
CVE-2026-56244 | High | 7.1 | 2026-06-24 | Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhoo… |
CVE-2026-56237 | Critical | 9.1 | 2026-06-24 | Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the ba… |
CVE-2026-56232 | High | 8.8 | 2026-06-24 | Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey functio… |
CVE-2026-56231 | High | 7.6 | 2026-06-24 | Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints… |
CVE-2026-56223 | High | 8.7 | 2026-06-24 | Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim… |
CVE-2026-56322 | High | 7.5 | 2026-06-23 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter befo… |
CVE-2026-56243 | High | 8.1 | 2026-06-23 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header desp… |
CVE-2026-56234 | Medium | 5.3 | 2026-06-23 | Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable u… |
CVE-2026-56225 | High | 8.3 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with mod… |
CVE-2026-56222 | High | 7.2 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped rol… |
CVE-2026-56324 | High | 8.2 | 2026-06-22 | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the… |
CVE-2026-56323 | High | 7.5 | 2026-06-22 | Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enum… |
CVE-2026-56321 | Medium | 5.3 | 2026-06-22 | Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint… |
CVE-2026-56314 | High | 7.1 | 2026-06-22 | Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. At… |
CVE-2026-56311 | Medium | 5.3 | 2026-06-22 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthenticated attackers… |
CVE-2026-56306 | Medium | 6.4 | 2026-06-22 | Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting mal… |
CVE-2026-56255 | Medium | 4.3 | 2026-06-22 | Capgo before 12.128.2 contains a denial of service vulnerability in the POST /app/demo endpoint that allows authenticated users with org write permissions to c… |
CVE-2026-56299 | Medium | 5.3 | 2026-06-21 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger c… |
CVE-2026-56253 | High | 7.5 | 2026-06-21 | Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enu… |
CVE-2026-56251 | Medium | 6.5 | 2026-06-21 | Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to su… |
CVE-2026-56242 | High | 7.5 | 2026-06-21 | Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys… |
CVE-2026-56239 | High | 7.6 | 2026-06-21 | Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensi… |
CVE-2026-56236 | Medium | 6.1 | 2026-06-21 | Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation… |
CVE-2026-56229 | Medium | 6.5 | 2026-06-21 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs… |
CVE-2026-56332 | Medium | 4.7 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external webs… |
CVE-2026-56330 | Low | 3.5 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, a… |
CVE-2026-56325 | Low | 3.1 | 2026-06-20 | Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters… |
CVE-2026-56319 | Medium | 4.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distingu… |
CVE-2026-56295 | Medium | 6.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_ap… |
CVE-2026-56282 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replicatio… |
CVE-2026-56228 | Medium | 4.9 | 2026-06-20 | Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization… |
CVE-2026-56227 | Medium | 5.4 | 2026-06-20 | Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization… |
CVE-2026-56218 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download… |
CVE-2026-56216 | High | 8.8 | 2026-06-20 | Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted… |
CVE-2026-56215 | High | 8.3 | 2026-06-20 | Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts… |
CVE-2026-56214 | High | 7.5 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthent… |
CVE-2026-56213 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, all… |
CVE-2026-56212 | Low | 3.8 | 2026-06-20 | Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-f… |
CVE-2026-56079 | Medium | 6.5 | 2026-06-19 | Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other te… |
CVE-2026-53868 | High | 7.5 | 2026-06-12 | Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification… |
CVE-2026-53867 | Medium | 4.3 | 2026-06-12 | Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned… |