CVEs we hold for Capgo
Records whose assigning authority named Capgo as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-56338Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointCapgo CVE-2026-56337Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2Capgo CVE-2026-56336Capgo - Information Disclosure via Unauthenticated SSO check-domain EndpointCapgo CVE-2026-56335Capgo - Channel Configuration Mutation via Write-Scoped API KeysCapgo CVE-2026-56334Capgo - Missing UPDATE RLS Policy for Build Status PersistenceCapgo CVE-2026-56333Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings UpdatesCapgo CVE-2026-56332Capgo - Open Redirect via confirmation_url ParameterCapgo CVE-2026-56331Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic StringCapgo CVE-2026-56330Capgo - Open Redirect via Unvalidated Stripe Billing URLsCapgo CVE-2026-56329Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore DecodingCapgo CVE-2026-56328Capgo - Integrity Issue in Release Routing via Multiple Public ChannelsCapgo CVE-2026-56327Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCCapgo CVE-2026-56325Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain LookupCapgo CVE-2026-56324Capgo - Rate Limit Bypass via User-Controlled device_id ParameterCapgo CVE-2026-56323Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_selfCapgo CVE-2026-56322Capgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterCapgo CVE-2026-56321Capgo - Missing Authentication Middleware on GET /private/role_bindings EndpointCapgo CVE-2026-56320Capgo - Org/App Scope Mismatch in Device Creation EndpointCapgo CVE-2026-56319Capgo - App Existence Oracle via GET /statistics/app/:app_idCapgo CVE-2026-56318Capgo - Information Disclosure via /private/validate_password_compliance EndpointCapgo CVE-2026-56314Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates EndpointCapgo CVE-2026-56313Capgo - Cross-Organization Account Disruption via SSO Prelink EndpointCapgo CVE-2026-56312Capgo - Account Creation Before CAPTCHA Validation in accept_invitation EndpointCapgo CVE-2026-56311Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPCCapgo CVE-2026-56309Capgo - Plan Bypass via Unrestricted Attachment Upload EndpointCapgo CVE-2026-56308Capgo - Insufficient Authentication in Email Change EndpointCapgo CVE-2026-56306Capgo - Subkey Enforcement Bypass via x-limited-key-id Header ParsingCapgo CVE-2026-56305Capgo - Authentication Bypass in Password Change via Missing Current Password ValidationCapgo CVE-2026-56303Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionCapgo CVE-2026-56302Capgo - Unsecured Supabase Images Bucket via Missing Row Level SecurityCapgo CVE-2026-56300Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsCapgo CVE-2026-56299Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload EndpointCapgo CVE-2026-56298Capgo - EXIF Metadata Exposure in App Information Image UploadCapgo CVE-2026-56295Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API KeysCapgo CVE-2026-56293Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()Capgo CVE-2026-56286Capgo - Account Deletion Without Password ConfirmationCapgo CVE-2026-56283Capgo - HTML Injection Leading to Open Redirection in Organization SettingsCapgo CVE-2026-56282Capgo - Information Disclosure via Unauthenticated /replication EndpointCapgo CVE-2026-56281Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats EndpointCapgo CVE-2026-56279Capgo - Information Disclosure via get_orgs_v7 RPC EndpointCapgo CVE-2026-56257Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST UpdateCapgo CVE-2026-56256Capgo - Two-Factor Authentication Bypass via Organization Management APICapgo CVE-2026-56255Capgo - Denial of Service via Unlimited Demo App CreationCapgo CVE-2026-56253Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPCCapgo CVE-2026-56252Capgo - Scope Isolation Failure in Webhook Test EndpointCapgo CVE-2026-56251Capgo - Privilege Escalation via Broken Row Level Security in org_usersCapgo CVE-2026-56250Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versionsCapgo CVE-2026-56249Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name CollisionCapgo CVE-2026-56247Capgo - Privilege Escalation via Cross-Scope RBAC Role AssignmentCapgo CVE-2026-56246Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege InheritanceCapgo CVE-2026-56244Capgo - Webhook Signing Secret Disclosure via Non-Admin API KeyCapgo CVE-2026-56243Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS PlaneCapgo CVE-2026-56242Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPCCapgo CVE-2026-56241Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_rightCapgo CVE-2026-56240Capgo - Billing Authorization Bypass via Exhausted Usage CreditsCapgo CVE-2026-56239Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overageCapgo CVE-2026-56238Capgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointCapgo CVE-2026-56237Capgo - Unauthenticated API Key Generation via Client-Side Parameter ManipulationCapgo CVE-2026-56236Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operationscapgo cli CVE-2026-56234Capgo - Password Spraying via Public-Key Accessible Credential Validation EndpointCapgo CVE-2026-56233Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload ProxyCapgo CVE-2026-56232Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id HeaderCapgo CVE-2026-56231Capgo - Broken Object Level Authorization in Build Job Control via jobId ParameterCapgo CVE-2026-56230Capgo - Broken Object Level Authorization via x-limited-key-id HeaderCapgo CVE-2026-56229Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logsCapgo CVE-2026-56228Capgo - Denial of Service via Improper Password Policy Length ValidationCapgo CVE-2026-56227Capgo - Server-Side Request Forgery via Webhook URL ValidationCapgo CVE-2026-56225Capgo - Authorization Bypass in API Key Management via App-Limited KeysCapgo CVE-2026-56224Capgo - Login CSRF and Session Fixation via URL Query ParametersCapgo CVE-2026-56223Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-userCapgo CVE-2026-56222Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindingsCapgo CVE-2026-56220Capgo - Unauthorized Manifest Insertion via Read-Only Org MemberCapgo CVE-2026-56219Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth BypassCapgo CVE-2026-56217Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST UpdateCapgo CVE-2026-56216Capgo - Scope Escalation via API Key Creation in /functions/v1/apikeyCapgo CVE-2026-56215Capgo - Account Merge via Poisoned public.users.email in SSO ProvisioningCapgo CVE-2026-56214Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPCCapgo CVE-2026-56213Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPCCapgo CVE-2026-56212Capgo - Improper 2FA Enforcement Logic via Team Security SettingsCapgo CVE-2026-56079Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook AccessCapgo CVE-2026-53868Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and DeletionCapgo CVE-2026-53867Capgo < 12.128.2 - Orphaned File Retention via Profile Image ReplacementCapgo 83 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.