Capgo vulnerabilities
83 CVEs and advisories name Capgo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56336Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint
- CVE-2026-56313Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint
- CVE-2026-56308Capgo - Insufficient Authentication in Email Change Endpoint
- CVE-2026-56281Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
- CVE-2026-56252Capgo - Scope Isolation Failure in Webhook Test Endpoint
- CVE-2026-56241Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
- CVE-2026-56238Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint
- CVE-2026-56303Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function
- CVE-2026-56240Capgo - Billing Authorization Bypass via Exhausted Usage Credits
- CVE-2026-56335Capgo - Channel Configuration Mutation via Write-Scoped API Keys
- CVE-2026-56329Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding
- CVE-2026-56312Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
- CVE-2026-56309Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint
- CVE-2026-56305Capgo - Authentication Bypass in Password Change via Missing Current Password Validation
- CVE-2026-56279Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
- CVE-2026-56298Capgo - EXIF Metadata Exposure in App Information Image Upload
- CVE-2026-56293Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()
- CVE-2026-56283Capgo - HTML Injection Leading to Open Redirection in Organization Settings
- CVE-2026-56250Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions
- CVE-2026-56246Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance
- CVE-2026-56220Capgo - Unauthorized Manifest Insertion via Read-Only Org Member
- CVE-2026-56217Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update
- CVE-2026-56334Capgo - Missing UPDATE RLS Policy for Build Status Persistence
- CVE-2026-56333Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates
- CVE-2026-56331Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String
- CVE-2026-56328Capgo - Integrity Issue in Release Routing via Multiple Public Channels
- CVE-2026-56327Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC
- CVE-2026-56320Capgo - Org/App Scope Mismatch in Device Creation Endpoint
- CVE-2026-56318Capgo - Information Disclosure via /private/validate_password_compliance Endpoint
- CVE-2026-56300Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions