Vulnerability · Published Jun 24, 2026 · Assigned by VulnCheck
CVE-2026-56302Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security
Medium 6.5
In plain English
A medium-severity improper access control in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 71.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-8hq3-gg3m-vwvr) vendor-advisory
- VulnCheck Advisory: Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security third-party-advisory