Cap-go / Capgo.app
23 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-100626 | capgo through 12.128.2 IDOR via PUT /app icon endpoint | MEDIUM | 5.3 | Sep 26, 2026 |
| CVE-2026-100629 | Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH | HIGH | 7.0 | Sep 26, 2026 |
| CVE-2026-100628 | capgo.app before 12.128.12 Authentication Bypass via apikey | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100627 | Capgo bundle promotion API channel RBAC deny override bypass | HIGH | 7.2 | Sep 26, 2026 |
| CVE-2026-100625 | Capgo Build Upload Proxy Authorization Bypass via TUS Resource | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100624 | Capgo.app before 12.264.5 Upload Expiry Bypass via build upload | MEDIUM | 5.3 | Sep 26, 2026 |
| CVE-2026-100623 | Capgo Authentication Bypass via Direct PostgREST org_users Table Write | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100622 | capgo.app through 12.129.0 Cache Restoration of Deleted Bundles | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100621 | capgo.app Content-Lock Bypass via r2-direct Bundle Mutation | MEDIUM | 5.3 | Sep 26, 2026 |
| CVE-2026-100619 | Capgo OTA Manifest Poisoning via app_versions.manifest Bypass | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100618 | Capgo App Icon Update Privilege Escalation via Service-Role Worker | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100617 | Cap-go capgo.app Authorization Bypass via channel_permission_overrides | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100616 | capgo.app Authentication Bypass via PostgREST customer_id Mutation | HIGH | 7.0 | Sep 26, 2026 |
| CVE-2026-100615 | Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100614 | Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker | HIGH | 8.7 | Sep 26, 2026 |
| CVE-2026-100613 | capgo.app Authorization Bypass via Stale Channel Permission Overrides | MEDIUM | 6.0 | Sep 26, 2026 |
| CVE-2026-100612 | Capgo SSO Provider ID Authentication Bypass via Incomplete Migration | HIGH | 8.6 | Sep 26, 2026 |
| CVE-2026-100611 | Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list | HIGH | 7.1 | Sep 26, 2026 |
| CVE-2026-88864 | Capgo SSO Provider Authentication Bypass via PostgREST Direct Write | CRITICAL | 9.3 | Sep 10, 2026 |
| CVE-2026-88863 | capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org | HIGH | 8.6 | Sep 10, 2026 |
| CVE-2026-88862 | Capgo API Key Manager Authentication Bypass via x-limited-key-id | HIGH | 8.7 | Sep 10, 2026 |
| CVE-2026-88861 | Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization | HIGH | 8.7 | Sep 10, 2026 |
| CVE-2026-88860 | Capgo Authorization Bypass via Stale Channel Permission Overrides | CRITICAL | 9.3 | Sep 10, 2026 |
Showing 1 to 23 of 23 CVEs