Capgo vulnerabilities

Latest high and critical flaws

• CVE-2026-56313 Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to deleteHigh 7.2 · Jul 12, 2026
• CVE-2026-56308 Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address.High 8.4 · Jul 12, 2026
• CVE-2026-56241 Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_High 7.2 · Jul 12, 2026
• CVE-2026-56238 Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to High 8.7 · Jul 12, 2026
• CVE-2026-56303 Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable byHigh 8.7 · Jul 11, 2026
• CVE-2026-56335 Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields throHigh 7.1 · Jul 10, 2026
• CVE-2026-56305 Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without reqHigh 8.7 · Jul 10, 2026
• CVE-2026-56279 Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended High 8.7 · Jul 10, 2026
• CVE-2026-56250 Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bunHigh 8.7 · Jul 8, 2026
• CVE-2026-56246 Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owHigh 7.2 · Jul 8, 2026
• CVE-2026-56220 Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifeHigh 7.1 · Jul 8, 2026
• CVE-2026-56328 Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChHigh 7.1 · Jun 30, 2026
• CVE-2026-56320 Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matcheHigh 7.1 · Jun 30, 2026
• CVE-2026-56300 Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and uHigh 8.7 · Jun 30, 2026
• CVE-2026-56286 Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication oHigh 7 · Jun 30, 2026
• CVE-2026-56249 Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing chanHigh 7.2 · Jun 30, 2026
• CVE-2026-56247 Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees.High 8.7 · Jun 30, 2026
• CVE-2026-56233 Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass uploaHigh 8.7 · Jun 30, 2026
• CVE-2026-56230 Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header wHigh 8.7 · Jun 30, 2026
• CVE-2026-56219 Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrievHigh 8.7 · Jun 30, 2026
• CVE-2026-56257 Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownershiHigh 7.1 · Jun 24, 2026
• CVE-2026-56256 Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level.High 7.1 · Jun 24, 2026
• CVE-2026-56244 Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhookHigh 7.1 · Jun 24, 2026
• CVE-2026-56237 Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism.Critical 9.3 · Jun 24, 2026
• CVE-2026-56232 Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey functionHigh 8.7 · Jun 24, 2026