Capgo vulnerabilities
83 CVEs and advisories name Capgo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56286Capgo - Account Deletion Without Password Confirmation
- CVE-2026-56249Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision
- CVE-2026-56247Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment
- CVE-2026-56233Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy
- CVE-2026-56230Capgo - Broken Object Level Authorization via x-limited-key-id Header
- CVE-2026-56224Capgo - Login CSRF and Session Fixation via URL Query Parameters
- CVE-2026-56219Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass
- CVE-2026-56338Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint
- CVE-2026-56337Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2
- CVE-2026-56302Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security
- CVE-2026-56257Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update
- CVE-2026-56256Capgo - Two-Factor Authentication Bypass via Organization Management API
- CVE-2026-56244Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key
- CVE-2026-56237Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation
- CVE-2026-56232Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header
- CVE-2026-56231Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter
- CVE-2026-56223Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
- CVE-2026-56322Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter
- CVE-2026-56243Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
- CVE-2026-56234Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint
- CVE-2026-56225Capgo - Authorization Bypass in API Key Management via App-Limited Keys
- CVE-2026-56222Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings
- CVE-2026-56324Capgo - Rate Limit Bypass via User-Controlled device_id Parameter
- CVE-2026-56323Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self
- CVE-2026-56321Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint
- CVE-2026-56314Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint
- CVE-2026-56311Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC
- CVE-2026-56306Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing
- CVE-2026-56255Capgo - Denial of Service via Unlimited Demo App Creation
- CVE-2026-56299Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint