Capgo vulnerabilities
83 CVEs and advisories name Capgo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56253Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC
- CVE-2026-56251Capgo - Privilege Escalation via Broken Row Level Security in org_users
- CVE-2026-56242Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC
- CVE-2026-56239Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage
- CVE-2026-56236Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations
- CVE-2026-56229Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs
- CVE-2026-56332Capgo - Open Redirect via confirmation_url Parameter
- CVE-2026-56330Capgo - Open Redirect via Unvalidated Stripe Billing URLs
- CVE-2026-56319Capgo - App Existence Oracle via GET /statistics/app/:app_id
- CVE-2026-56295Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys
- CVE-2026-56282Capgo - Information Disclosure via Unauthenticated /replication Endpoint
- CVE-2026-56228Capgo - Denial of Service via Improper Password Policy Length Validation
- CVE-2026-56227Capgo - Server-Side Request Forgery via Webhook URL Validation
- CVE-2026-56218Capgo - EXIF Metadata Exposure via Image Upload
- CVE-2026-56325Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup
- CVE-2026-56216Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey
- CVE-2026-56215Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning
- CVE-2026-56214Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC
- CVE-2026-56213Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC
- CVE-2026-56212Capgo - Improper 2FA Enforcement Logic via Team Security Settings
- CVE-2026-56079Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access
- CVE-2026-53868Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion
- CVE-2026-53867Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement