CVE-2026-56336Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 07/12/2026 Severity Medium CVE-2026-56313Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint Exploitation status Not known exploited Fix Affected product C Capgo Published 07/12/2026 Severity High CVE-2026-56308Capgo - Insufficient Authentication in Email Change Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 07/12/2026 Severity High CVE-2026-56281Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 07/12/2026 Severity Medium CVE-2026-56252Capgo - Scope Isolation Failure in Webhook Test Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 07/12/2026 Severity Medium CVE-2026-56241Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right Exploitation status Public exploit Fix Affected product C Capgo Published 07/12/2026 Severity High CVE-2026-56238Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 07/12/2026 Severity High CVE-2026-56303Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function Exploitation status Public exploit Fix Affected product C Capgo Published 07/11/2026 Severity High CVE-2026-56240Capgo - Billing Authorization Bypass via Exhausted Usage Credits Exploitation status Public exploit Fix Affected product C Capgo Published 07/11/2026 Severity Medium CVE-2026-56335Capgo - Channel Configuration Mutation via Write-Scoped API Keys Exploitation status Public exploit Fix Affected product C Capgo Published 07/10/2026 Severity High CVE-2026-56329Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding Exploitation status Public exploit Fix Affected product C Capgo Published 07/10/2026 Severity Medium CVE-2026-56312Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint Exploitation status Not known exploited Fix Affected product C Capgo Published 07/10/2026 Severity Medium CVE-2026-56309Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 07/10/2026 Severity Medium CVE-2026-56305Capgo - Authentication Bypass in Password Change via Missing Current Password Validation Exploitation status Public exploit Fix Affected product C Capgo Published 07/10/2026 Severity High CVE-2026-56279Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 07/10/2026 Severity High CVE-2026-56298Capgo - EXIF Metadata Exposure in App Information Image Upload Exploitation status Not known exploited Fix Affected product C Capgo Published 07/08/2026 Severity Medium CVE-2026-56293Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app() Exploitation status Public exploit Fix Affected product C Capgo Published 07/08/2026 Severity Medium CVE-2026-56283Capgo - HTML Injection Leading to Open Redirection in Organization Settings Exploitation status Public exploit Fix Affected product C Capgo Published 07/08/2026 Severity Medium CVE-2026-56250Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions Exploitation status Public exploit Fix Affected product C Capgo Published 07/08/2026 Severity High CVE-2026-56246Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance Exploitation status Public exploit Fix Affected product C Capgo Published 07/08/2026 Severity High CVE-2026-56220Capgo - Unauthorized Manifest Insertion via Read-Only Org Member Exploitation status Public exploit Fix Affected product C Capgo Published 07/08/2026 Severity High CVE-2026-56217Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update Exploitation status Public exploit Fix Affected product C Capgo Published 07/08/2026 Severity Medium CVE-2026-56334Capgo - Missing UPDATE RLS Policy for Build Status Persistence Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity Medium CVE-2026-56333Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity Medium CVE-2026-56331Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity Medium CVE-2026-56328Capgo - Integrity Issue in Release Routing via Multiple Public Channels Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56327Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity Medium CVE-2026-56320Capgo - Org/App Scope Mismatch in Device Creation Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56318Capgo - Information Disclosure via /private/validate_password_compliance Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity Medium CVE-2026-56300Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56286Capgo - Account Deletion Without Password Confirmation Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56249Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56247Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56233Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56230Capgo - Broken Object Level Authorization via x-limited-key-id Header Exploitation status Not known exploited Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56224Capgo - Login CSRF and Session Fixation via URL Query Parameters Exploitation status Not known exploited Fix Affected product C Capgo Published 06/30/2026 Severity Medium CVE-2026-56219Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass Exploitation status Public exploit Fix Affected product C Capgo Published 06/30/2026 Severity High CVE-2026-56338Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity Medium CVE-2026-56337Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2 Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity Medium CVE-2026-56302Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity Medium CVE-2026-56257Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity High CVE-2026-56256Capgo - Two-Factor Authentication Bypass via Organization Management API Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity High CVE-2026-56244Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity High CVE-2026-56237Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity Critical CVE-2026-56232Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity High CVE-2026-56231Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity High CVE-2026-56223Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user Exploitation status Public exploit Fix Affected product C Capgo Published 06/24/2026 Severity Critical CVE-2026-56322Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter Exploitation status Public exploit Fix Affected product C Capgo Published 06/23/2026 Severity High CVE-2026-56243Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane Exploitation status Public exploit Fix Affected product C Capgo Published 06/23/2026 Severity High CVE-2026-56234Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 06/23/2026 Severity Medium CVE-2026-56225Capgo - Authorization Bypass in API Key Management via App-Limited Keys Exploitation status Public exploit Fix Affected product C Capgo Published 06/23/2026 Severity High CVE-2026-56222Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings Exploitation status Public exploit Fix Affected product C Capgo Published 06/23/2026 Severity High CVE-2026-56324Capgo - Rate Limit Bypass via User-Controlled device_id Parameter Exploitation status Public exploit Fix Affected product C Capgo Published 06/22/2026 Severity High CVE-2026-56323Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self Exploitation status Public exploit Fix Affected product C Capgo Published 06/22/2026 Severity High CVE-2026-56321Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint Exploitation status Not known exploited Fix Affected product C Capgo Published 06/22/2026 Severity Medium CVE-2026-56314Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 06/22/2026 Severity High CVE-2026-56311Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC Exploitation status Public exploit Fix Affected product C Capgo Published 06/22/2026 Severity Medium CVE-2026-56306Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing Exploitation status Public exploit Fix Affected product C Capgo Published 06/22/2026 Severity Medium CVE-2026-56255Capgo - Denial of Service via Unlimited Demo App Creation Exploitation status Public exploit Fix Affected product C Capgo Published 06/22/2026 Severity Medium CVE-2026-56299Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint Exploitation status Not known exploited Fix Affected product C Capgo Published 06/21/2026 Severity Medium CVE-2026-56253Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC Exploitation status Public exploit Fix Affected product C Capgo Published 06/21/2026 Severity High CVE-2026-56251Capgo - Privilege Escalation via Broken Row Level Security in org_users Exploitation status Not known exploited Fix Affected product C Capgo Published 06/21/2026 Severity High CVE-2026-56242Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC Exploitation status Public exploit Fix Affected product C Capgo Published 06/21/2026 Severity High CVE-2026-56239Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage Exploitation status Public exploit Fix Affected product C Capgo Published 06/21/2026 Severity High CVE-2026-56236Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations Exploitation status Public exploit Fix Affected product C cli Published 06/21/2026 Severity Medium CVE-2026-56229Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs Exploitation status Public exploit Fix Affected product C Capgo Published 06/21/2026 Severity High CVE-2026-56332Capgo - Open Redirect via confirmation_url Parameter Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56330Capgo - Open Redirect via Unvalidated Stripe Billing URLs Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56319Capgo - App Existence Oracle via GET /statistics/app/:app_id Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56295Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56282Capgo - Information Disclosure via Unauthenticated /replication Endpoint Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56228Capgo - Denial of Service via Improper Password Policy Length Validation Exploitation status Not known exploited Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56227Capgo - Server-Side Request Forgery via Webhook URL Validation Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56218Capgo - EXIF Metadata Exposure via Image Upload Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56325Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Low CVE-2026-56216Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity High CVE-2026-56215Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity High CVE-2026-56214Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity High CVE-2026-56213Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56212Capgo - Improper 2FA Enforcement Logic via Team Security Settings Exploitation status Public exploit Fix Affected product C Capgo Published 06/20/2026 Severity Medium CVE-2026-56079Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access Exploitation status Public exploit Fix Affected product C Capgo Published 06/19/2026 Severity High CVE-2026-53868Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion Exploitation status Not known exploited Fix Affected product C Capgo Published 06/12/2026 Severity High CVE-2026-53867Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement Exploitation status Not known exploited Fix Affected product C Capgo Published 06/12/2026 Severity Medium 
