Cap-go / Capgo
82 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-56339 | Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC | HIGH | 8.7 | Jul 15, 2026 |
| CVE-2026-56336 | Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint | MEDIUM | 6.9 | Jul 12, 2026 |
| CVE-2026-56313 | Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint | HIGH | 7.2 | Jul 12, 2026 |
| CVE-2026-56308 | Capgo - Insufficient Authentication in Email Change Endpoint | HIGH | 8.4 | Jul 12, 2026 |
| CVE-2026-56281 | Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint | MEDIUM | 5.1 | Jul 12, 2026 |
| CVE-2026-56252 | Capgo - Scope Isolation Failure in Webhook Test Endpoint | MEDIUM | 5.3 | Jul 12, 2026 |
| CVE-2026-56241 | Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right | HIGH | 7.2 | Jul 12, 2026 |
| CVE-2026-56238 | Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint | HIGH | 8.7 | Jul 12, 2026 |
| CVE-2026-56303 | Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function | HIGH | 8.7 | Jul 11, 2026 |
| CVE-2026-56296 | Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC | MEDIUM | 6.9 | Jul 11, 2026 |
| CVE-2026-56240 | Capgo - Billing Authorization Bypass via Exhausted Usage Credits | MEDIUM | 5.3 | Jul 11, 2026 |
| CVE-2026-56335 | Capgo - Channel Configuration Mutation via Write-Scoped API Keys | HIGH | 7.1 | Jul 10, 2026 |
| CVE-2026-56329 | Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding | MEDIUM | 5.3 | Jul 10, 2026 |
| CVE-2026-56312 | Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint | MEDIUM | 6.9 | Jul 10, 2026 |
| CVE-2026-56309 | Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint | MEDIUM | 5.3 | Jul 10, 2026 |
| CVE-2026-56305 | Capgo - Authentication Bypass in Password Change via Missing Current Password Validation | HIGH | 8.7 | Jul 10, 2026 |
| CVE-2026-56279 | Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint | HIGH | 8.7 | Jul 10, 2026 |
| CVE-2026-56298 | Capgo - EXIF Metadata Exposure in App Information Image Upload | MEDIUM | 5.3 | Jul 8, 2026 |
| CVE-2026-56293 | Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app() | MEDIUM | 5.3 | Jul 8, 2026 |
| CVE-2026-56284 | Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC | MEDIUM | 6.9 | Jul 8, 2026 |
| CVE-2026-56283 | Capgo - HTML Injection Leading to Open Redirection in Organization Settings | MEDIUM | 4.8 | Jul 8, 2026 |
| CVE-2026-56250 | Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions | HIGH | 8.7 | Jul 8, 2026 |
| CVE-2026-56246 | Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance | HIGH | 7.2 | Jul 8, 2026 |
| CVE-2026-56226 | Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC | HIGH | 8.7 | Jul 8, 2026 |
| CVE-2026-56220 | Capgo - Unauthorized Manifest Insertion via Read-Only Org Member | HIGH | 7.1 | Jul 8, 2026 |
Showing 1 to 25 of 82 CVEs