# cve.now: Cap-go

The newest entries naming Cap-go as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-100626](https://cve.now/CVE-2026-100626.md): capgo through 12.128.2 IDOR via PUT /app icon endpoint (CVSS 5.3)
- [CVE-2026-100629](https://cve.now/CVE-2026-100629.md): Capgo backend before 12.127.5 Privilege Escalation via role\_bindings PATCH (CVSS 7.0)
- [CVE-2026-100628](https://cve.now/CVE-2026-100628.md): capgo.app before 12.128.12 Authentication Bypass via apikey (CVSS 8.7)
- [CVE-2026-100627](https://cve.now/CVE-2026-100627.md): Capgo bundle promotion API channel RBAC deny override bypass (CVSS 7.2)
- [CVE-2026-100625](https://cve.now/CVE-2026-100625.md): Capgo Build Upload Proxy Authorization Bypass via TUS Resource (CVSS 8.7)
- [CVE-2026-100624](https://cve.now/CVE-2026-100624.md): Capgo.app before 12.264.5 Upload Expiry Bypass via build upload (CVSS 5.3)
- [CVE-2026-100623](https://cve.now/CVE-2026-100623.md): Capgo Authentication Bypass via Direct PostgREST org\_users Table Write (CVSS 8.7)
- [CVE-2026-100622](https://cve.now/CVE-2026-100622.md): capgo.app through 12.129.0 Cache Restoration of Deleted Bundles (CVSS 8.7)
- [CVE-2026-100621](https://cve.now/CVE-2026-100621.md): capgo.app Content-Lock Bypass via r2-direct Bundle Mutation (CVSS 5.3)
- [CVE-2026-100620](https://cve.now/CVE-2026-100620.md): Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account (CVSS 5.1)
- [CVE-2026-100619](https://cve.now/CVE-2026-100619.md): Capgo OTA Manifest Poisoning via app\_versions.manifest Bypass (CVSS 8.7)
- [CVE-2026-100618](https://cve.now/CVE-2026-100618.md): Capgo App Icon Update Privilege Escalation via Service-Role Worker (CVSS 8.7)
- [CVE-2026-100617](https://cve.now/CVE-2026-100617.md): Cap-go capgo.app Authorization Bypass via channel\_permission\_overrides (CVSS 8.7)
- [CVE-2026-100616](https://cve.now/CVE-2026-100616.md): capgo.app Authentication Bypass via PostgREST customer\_id Mutation (CVSS 7.0)
- [CVE-2026-100615](https://cve.now/CVE-2026-100615.md): Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation (CVSS 8.7)
- [CVE-2026-100614](https://cve.now/CVE-2026-100614.md): Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker (CVSS 8.7)
- [CVE-2026-100613](https://cve.now/CVE-2026-100613.md): capgo.app Authorization Bypass via Stale Channel Permission Overrides (CVSS 6.0)
- [CVE-2026-100612](https://cve.now/CVE-2026-100612.md): Capgo SSO Provider ID Authentication Bypass via Incomplete Migration (CVSS 8.6)
- [CVE-2026-100611](https://cve.now/CVE-2026-100611.md): Capgo apikey\_manager Role Privilege Escalation via Incomplete Role Deny-list (CVSS 7.1)
- [CVE-2026-88864](https://cve.now/CVE-2026-88864.md): Capgo SSO Provider Authentication Bypass via PostgREST Direct Write (CVSS 9.3)
- [CVE-2026-88863](https://cve.now/CVE-2026-88863.md): capgo.app through 12.207.1 Privilege Escalation via invite\_new\_user\_to\_org (CVSS 8.6)
- [CVE-2026-88862](https://cve.now/CVE-2026-88862.md): Capgo API Key Manager Authentication Bypass via x-limited-key-id (CVSS 8.7)
- [CVE-2026-88861](https://cve.now/CVE-2026-88861.md): Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization (CVSS 8.7)
- [CVE-2026-88860](https://cve.now/CVE-2026-88860.md): Capgo Authorization Bypass via Stale Channel Permission Overrides (CVSS 9.3)
- [CVE-2026-56339](https://cve.now/CVE-2026-56339.md): Capgo - Unauthenticated Organization Existence Enumeration via rescind\_invitation RPC (CVSS 8.7)
- [CVE-2026-56296](https://cve.now/CVE-2026-56296.md): Cap-go - App Existence Oracle via Unauthenticated transfer\_app RPC (CVSS 6.9)
- [CVE-2026-56284](https://cve.now/CVE-2026-56284.md): Capgo - Unauthenticated Metrics Disclosure via get\_total\_metrics RPC (CVSS 6.9)
- [CVE-2026-56226](https://cve.now/CVE-2026-56226.md): Capgo - Unauthenticated Organization Data Disclosure via get\_orgs\_v6 RPC (CVSS 8.7)
- [CVE-2026-56310](https://cve.now/CVE-2026-56310.md): Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass (CVSS 5.3)
- [CVE-2026-56245](https://cve.now/CVE-2026-56245.md): Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record\_build\_time RPC (CVSS 8.8)
- [CVE-2026-56248](https://cve.now/CVE-2026-56248.md): Capgo - Unauthenticated Denial-of-Service via audit\_logs RLS Policy (CVSS 8.7)
- [CVE-2026-56280](https://cve.now/CVE-2026-56280.md): Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect (CVSS 7.1)
- [CVE-2026-56221](https://cve.now/CVE-2026-56221.md): Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts (CVSS 7.1)
- [CVE-2026-56316](https://cve.now/CVE-2026-56316.md): Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/ (CVSS 6.9)
- [CVE-2026-56307](https://cve.now/CVE-2026-56307.md): Cap-go - Broken Cursor Pagination in /private/devices Endpoint (CVSS 5.3)
- [CVE-2026-56235](https://cve.now/CVE-2026-56235.md): Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions (CVSS 6.9)
- [CVE-2026-56082](https://cve.now/CVE-2026-56082.md): Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record\_build\_time RPC (CVSS 8.7)
- [CVE-2026-56081](https://cve.now/CVE-2026-56081.md): Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email (CVSS 9.3)
- [CVE-2026-56080](https://cve.now/CVE-2026-56080.md): Cap-go - Authentication Logic Flaw in Enforce Password Policy (CVSS 6.9)
- [CVE-2026-56073](https://cve.now/CVE-2026-56073.md): Cap-go - OTP Bypass via Response Manipulation in Email Verification (CVSS 9.3)
- [CVE-2026-53982](https://cve.now/CVE-2026-53982.md): Cap-go Console \< 12.28.2 Account Deletion DoS via Device Identifier Association (CVSS 7.1)
- [CVE-2026-53981](https://cve.now/CVE-2026-53981.md): Cap-go \< v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cap-go
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.