Cap-go vulnerabilities
42 CVEs and advisories name Cap-go as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-100626capgo through 12.128.2 IDOR via PUT /app icon endpoint
- CVE-2026-100629Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
- CVE-2026-100628capgo.app before 12.128.12 Authentication Bypass via apikey
- CVE-2026-100627Capgo bundle promotion API channel RBAC deny override bypass
- CVE-2026-100625Capgo Build Upload Proxy Authorization Bypass via TUS Resource
- CVE-2026-100624Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
- CVE-2026-100623Capgo Authentication Bypass via Direct PostgREST org_users Table Write
- CVE-2026-100622capgo.app through 12.129.0 Cache Restoration of Deleted Bundles
- CVE-2026-100621capgo.app Content-Lock Bypass via r2-direct Bundle Mutation
- CVE-2026-100620Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account
- CVE-2026-100619Capgo OTA Manifest Poisoning via app_versions.manifest Bypass
- CVE-2026-100618Capgo App Icon Update Privilege Escalation via Service-Role Worker
- CVE-2026-100617Cap-go capgo.app Authorization Bypass via channel_permission_overrides
- CVE-2026-100616capgo.app Authentication Bypass via PostgREST customer_id Mutation
- CVE-2026-100615Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
- CVE-2026-100614Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker
- CVE-2026-100613capgo.app Authorization Bypass via Stale Channel Permission Overrides
- CVE-2026-100612Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
- CVE-2026-100611Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list
- CVE-2026-88864Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
- CVE-2026-88863capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
- CVE-2026-88862Capgo API Key Manager Authentication Bypass via x-limited-key-id
- CVE-2026-88861Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
- CVE-2026-88860Capgo Authorization Bypass via Stale Channel Permission Overrides
- CVE-2026-56339Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC
- CVE-2026-56296Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC
- CVE-2026-56284Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC
- CVE-2026-56226Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC
- CVE-2026-56310Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass
- CVE-2026-56245Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC