Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-56309Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint

Medium 5.4

In plain English

A medium-severity resource allocation without limits in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 75.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

GitHub Security Advisory (GHSA-q52j-ggvx-cr4v) vendor-advisory
VulnCheck Advisory: Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint third-party-advisory