# cve.now: Capgo

The newest entries naming Capgo as an affected vendor (up to 200), of 83 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-56336](https://cve.now/CVE-2026-56336.md): Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint (CVSS 6.9)
- [CVE-2026-56313](https://cve.now/CVE-2026-56313.md): Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint (CVSS 7.2)
- [CVE-2026-56308](https://cve.now/CVE-2026-56308.md): Capgo - Insufficient Authentication in Email Change Endpoint (CVSS 8.4)
- [CVE-2026-56281](https://cve.now/CVE-2026-56281.md): Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint (CVSS 5.1)
- [CVE-2026-56252](https://cve.now/CVE-2026-56252.md): Capgo - Scope Isolation Failure in Webhook Test Endpoint (CVSS 5.3)
- [CVE-2026-56241](https://cve.now/CVE-2026-56241.md): Capgo - RBAC Demotion Privilege Retention via Stale org\_users.user\_right (CVSS 7.2)
- [CVE-2026-56238](https://cve.now/CVE-2026-56238.md): Capgo - Unauthenticated Information Disclosure via PostgREST global\_stats Endpoint (CVSS 8.7)
- [CVE-2026-56303](https://cve.now/CVE-2026-56303.md): Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function (CVSS 8.7)
- [CVE-2026-56240](https://cve.now/CVE-2026-56240.md): Capgo - Billing Authorization Bypass via Exhausted Usage Credits (CVSS 5.3)
- [CVE-2026-56335](https://cve.now/CVE-2026-56335.md): Capgo - Channel Configuration Mutation via Write-Scoped API Keys (CVSS 7.1)
- [CVE-2026-56329](https://cve.now/CVE-2026-56329.md): Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding (CVSS 5.3)
- [CVE-2026-56312](https://cve.now/CVE-2026-56312.md): Capgo - Account Creation Before CAPTCHA Validation in accept\_invitation Endpoint (CVSS 6.9)
- [CVE-2026-56309](https://cve.now/CVE-2026-56309.md): Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint (CVSS 5.3)
- [CVE-2026-56305](https://cve.now/CVE-2026-56305.md): Capgo - Authentication Bypass in Password Change via Missing Current Password Validation (CVSS 8.7)
- [CVE-2026-56279](https://cve.now/CVE-2026-56279.md): Capgo - Information Disclosure via get\_orgs\_v7 RPC Endpoint (CVSS 8.7)
- [CVE-2026-56298](https://cve.now/CVE-2026-56298.md): Capgo - EXIF Metadata Exposure in App Information Image Upload (CVSS 5.3)
- [CVE-2026-56293](https://cve.now/CVE-2026-56293.md): Capgo - Stale Cross-Organization Authorization via Incomplete deploy\_history Update in transfer\_app() (CVSS 5.3)
- [CVE-2026-56283](https://cve.now/CVE-2026-56283.md): Capgo - HTML Injection Leading to Open Redirection in Organization Settings (CVSS 4.8)
- [CVE-2026-56250](https://cve.now/CVE-2026-56250.md): Capgo - Arbitrary R2 Object Deletion via Mutable r2\_path in app\_versions (CVSS 8.7)
- [CVE-2026-56246](https://cve.now/CVE-2026-56246.md): Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance (CVSS 7.2)
- [CVE-2026-56220](https://cve.now/CVE-2026-56220.md): Capgo - Unauthorized Manifest Insertion via Read-Only Org Member (CVSS 7.1)
- [CVE-2026-56217](https://cve.now/CVE-2026-56217.md): Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update (CVSS 5.3)
- [CVE-2026-56334](https://cve.now/CVE-2026-56334.md): Capgo - Missing UPDATE RLS Policy for Build Status Persistence (CVSS 5.3)
- [CVE-2026-56333](https://cve.now/CVE-2026-56333.md): Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates (CVSS 5.3)
- [CVE-2026-56331](https://cve.now/CVE-2026-56331.md): Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String (CVSS 6.9)
- [CVE-2026-56328](https://cve.now/CVE-2026-56328.md): Capgo - Integrity Issue in Release Routing via Multiple Public Channels (CVSS 7.1)
- [CVE-2026-56327](https://cve.now/CVE-2026-56327.md): Capgo - Unauthenticated Organization Existence Oracle via public.invite\_user\_to\_org RPC (CVSS 6.9)
- [CVE-2026-56320](https://cve.now/CVE-2026-56320.md): Capgo - Org/App Scope Mismatch in Device Creation Endpoint (CVSS 7.1)
- [CVE-2026-56318](https://cve.now/CVE-2026-56318.md): Capgo - Information Disclosure via /private/validate\_password\_compliance Endpoint (CVSS 6.9)
- [CVE-2026-56300](https://cve.now/CVE-2026-56300.md): Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions (CVSS 8.7)
- [CVE-2026-56286](https://cve.now/CVE-2026-56286.md): Capgo - Account Deletion Without Password Confirmation (CVSS 7.0)
- [CVE-2026-56249](https://cve.now/CVE-2026-56249.md): Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision (CVSS 7.2)
- [CVE-2026-56247](https://cve.now/CVE-2026-56247.md): Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment (CVSS 8.7)
- [CVE-2026-56233](https://cve.now/CVE-2026-56233.md): Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy (CVSS 8.7)
- [CVE-2026-56230](https://cve.now/CVE-2026-56230.md): Capgo - Broken Object Level Authorization via x-limited-key-id Header (CVSS 8.7)
- [CVE-2026-56224](https://cve.now/CVE-2026-56224.md): Capgo - Login CSRF and Session Fixation via URL Query Parameters (CVSS 5.1)
- [CVE-2026-56219](https://cve.now/CVE-2026-56219.md): Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get\_org\_user\_access\_rbac NULL-auth Bypass (CVSS 8.7)
- [CVE-2026-56338](https://cve.now/CVE-2026-56338.md): Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint (CVSS 6.9)
- [CVE-2026-56337](https://cve.now/CVE-2026-56337.md): Capgo - Information Disclosure via Unauthenticated RPC Function exist\_app\_v2 (CVSS 6.9)
- [CVE-2026-56302](https://cve.now/CVE-2026-56302.md): Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security (CVSS 6.9)
- [CVE-2026-56257](https://cve.now/CVE-2026-56257.md): Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update (CVSS 7.1)
- [CVE-2026-56256](https://cve.now/CVE-2026-56256.md): Capgo - Two-Factor Authentication Bypass via Organization Management API (CVSS 7.1)
- [CVE-2026-56244](https://cve.now/CVE-2026-56244.md): Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key (CVSS 7.1)
- [CVE-2026-56237](https://cve.now/CVE-2026-56237.md): Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation (CVSS 9.3)
- [CVE-2026-56232](https://cve.now/CVE-2026-56232.md): Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header (CVSS 8.7)
- [CVE-2026-56231](https://cve.now/CVE-2026-56231.md): Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter (CVSS 7.2)
- [CVE-2026-56223](https://cve.now/CVE-2026-56223.md): Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user (CVSS 9.3)
- [CVE-2026-56322](https://cve.now/CVE-2026-56322.md): Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter (CVSS 8.7)
- [CVE-2026-56243](https://cve.now/CVE-2026-56243.md): Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane (CVSS 8.6)
- [CVE-2026-56234](https://cve.now/CVE-2026-56234.md): Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint (CVSS 6.9)
- [CVE-2026-56225](https://cve.now/CVE-2026-56225.md): Capgo - Authorization Bypass in API Key Management via App-Limited Keys (CVSS 8.7)
- [CVE-2026-56222](https://cve.now/CVE-2026-56222.md): Capgo - Cross-Organization App Takeover via Mismatched org\_id and app\_id in /private/role\_bindings (CVSS 8.6)
- [CVE-2026-56324](https://cve.now/CVE-2026-56324.md): Capgo - Rate Limit Bypass via User-Controlled device\_id Parameter (CVSS 8.8)
- [CVE-2026-56323](https://cve.now/CVE-2026-56323.md): Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel\_self (CVSS 8.7)
- [CVE-2026-56321](https://cve.now/CVE-2026-56321.md): Capgo - Missing Authentication Middleware on GET /private/role\_bindings Endpoint (CVSS 6.9)
- [CVE-2026-56314](https://cve.now/CVE-2026-56314.md): Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint (CVSS 7.1)
- [CVE-2026-56311](https://cve.now/CVE-2026-56311.md): Capgo - Unauthenticated Cross-Tenant Disclosure via get\_current\_plan\_max\_org RPC (CVSS 6.9)
- [CVE-2026-56306](https://cve.now/CVE-2026-56306.md): Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing (CVSS 5.3)
- [CVE-2026-56255](https://cve.now/CVE-2026-56255.md): Capgo - Denial of Service via Unlimited Demo App Creation (CVSS 5.3)
- [CVE-2026-56299](https://cve.now/CVE-2026-56299.md): Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint (CVSS 6.9)
- [CVE-2026-56253](https://cve.now/CVE-2026-56253.md): Capgo - Unauthenticated Organization Member Email Disclosure via get\_org\_members RPC (CVSS 8.7)
- [CVE-2026-56251](https://cve.now/CVE-2026-56251.md): Capgo - Privilege Escalation via Broken Row Level Security in org\_users (CVSS 7.0)
- [CVE-2026-56242](https://cve.now/CVE-2026-56242.md): Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get\_identity\_apikey\_only RPC (CVSS 8.7)
- [CVE-2026-56239](https://cve.now/CVE-2026-56239.md): Capgo - Privilege Escalation via SECURITY DEFINER Function apply\_usage\_overage (CVSS 7.2)
- [CVE-2026-56236](https://cve.now/CVE-2026-56236.md): Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations (CVSS 6.8)
- [CVE-2026-56229](https://cve.now/CVE-2026-56229.md): Capgo - Cross-App Build Job Access via app\_id/job\_id Mismatch in /build/status and /build/logs (CVSS 7.1)
- [CVE-2026-56332](https://cve.now/CVE-2026-56332.md): Capgo - Open Redirect via confirmation\_url Parameter (CVSS 5.1)
- [CVE-2026-56330](https://cve.now/CVE-2026-56330.md): Capgo - Open Redirect via Unvalidated Stripe Billing URLs (CVSS 4.8)
- [CVE-2026-56319](https://cve.now/CVE-2026-56319.md): Capgo - App Existence Oracle via GET /statistics/app/:app\_id (CVSS 5.3)
- [CVE-2026-56295](https://cve.now/CVE-2026-56295.md): Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys (CVSS 5.3)
- [CVE-2026-56282](https://cve.now/CVE-2026-56282.md): Capgo - Information Disclosure via Unauthenticated /replication Endpoint (CVSS 6.9)
- [CVE-2026-56228](https://cve.now/CVE-2026-56228.md): Capgo - Denial of Service via Improper Password Policy Length Validation (CVSS 6.9)
- [CVE-2026-56227](https://cve.now/CVE-2026-56227.md): Capgo - Server-Side Request Forgery via Webhook URL Validation (CVSS 5.3)
- [CVE-2026-56218](https://cve.now/CVE-2026-56218.md): Capgo - EXIF Metadata Exposure via Image Upload (CVSS 6.9)
- [CVE-2026-56325](https://cve.now/CVE-2026-56325.md): Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup (CVSS 2.3)
- [CVE-2026-56216](https://cve.now/CVE-2026-56216.md): Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey (CVSS 8.7)
- [CVE-2026-56215](https://cve.now/CVE-2026-56215.md): Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning (CVSS 8.7)
- [CVE-2026-56214](https://cve.now/CVE-2026-56214.md): Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC (CVSS 8.7)
- [CVE-2026-56213](https://cve.now/CVE-2026-56213.md): Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert\_version\_meta RPC (CVSS 6.9)
- [CVE-2026-56212](https://cve.now/CVE-2026-56212.md): Capgo - Improper 2FA Enforcement Logic via Team Security Settings (CVSS 5.1)
- [CVE-2026-56079](https://cve.now/CVE-2026-56079.md): Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access (CVSS 7.1)
- [CVE-2026-53868](https://cve.now/CVE-2026-53868.md): Capgo \< 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion (CVSS 8.7)
- [CVE-2026-53867](https://cve.now/CVE-2026-53867.md): Capgo \< 12.128.2 - Orphaned File Retention via Profile Image Replacement (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/capgo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.