CCap-go

Products

Exploited and recent CVEs

• CVE-2026-100626 Medium 4.3 capgo through 12.128.2 IDOR via PUT /app icon endpoint 0.2%
• CVE-2026-100629 Medium 5.5 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH 0.3%
• CVE-2026-100628 Medium 4.3 capgo.app before 12.128.12 Authentication Bypass via apikey 0.2%
• CVE-2026-100627 High 8.1 Capgo bundle promotion API channel RBAC deny override bypass 0.4%
• CVE-2026-100625 High 7.1 Capgo Build Upload Proxy Authorization Bypass via TUS Resource 0.3%
• CVE-2026-100624 Medium 5.4 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload 0.3%
• CVE-2026-100623 High 8.8 Capgo Authentication Bypass via Direct PostgREST org_users Table Write 0.4%
• CVE-2026-100622 High 7.5 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles 0.4%
• CVE-2026-100621 Medium 4.3 capgo.app Content-Lock Bypass via r2-direct Bundle Mutation 0.3%
• CVE-2026-100620 Low 3.8 Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account 0.3%
• CVE-2026-100619 High 8.8 Capgo OTA Manifest Poisoning via app_versions.manifest Bypass 0.4%
• CVE-2026-100618 High 8.5 Capgo App Icon Update Privilege Escalation via Service-Role Worker 0.3%
• CVE-2026-100617 High 8.8 Cap-go capgo.app Authorization Bypass via channel_permission_overrides 0.4%
• CVE-2026-100616 Medium 5.5 capgo.app Authentication Bypass via PostgREST customer_id Mutation 0.3%
• CVE-2026-100615 High 8.8 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation 0.4%
• CVE-2026-100614 High 8.8 Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker 0.4%
• CVE-2026-100613 Medium 5.3 capgo.app Authorization Bypass via Stale Channel Permission Overrides 0.2%
• CVE-2026-100612 High 7.2 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration 0.3%
• CVE-2026-100611 Medium 6.5 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list 0.3%
• CVE-2026-88864 Critical 9.1 Capgo SSO Provider Authentication Bypass via PostgREST Direct Write 0.4%
• CVE-2026-88863 High 8.1 capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org 0.4%
• CVE-2026-88862 High 8.8 Capgo API Key Manager Authentication Bypass via x-limited-key-id 0.4%
• CVE-2026-88861 High 8.3 Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization 0.5%
• CVE-2026-88860 Medium 6.3 Capgo Authorization Bypass via Stale Channel Permission Overrides 0.3%
• CVE-2026-56339 High 7.5 Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC 0.4%
• CVE-2026-56296 Medium 5.3 Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC 0.3%
• CVE-2026-56284 Medium 5.3 Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC 0.3%
• CVE-2026-56226 High 7.5 Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC 0.3%
• CVE-2026-56310 Medium 4.3 Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass 0.2%
• CVE-2026-56245 High 8.2 Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC 0.3%