[ Vendor · 19 CVEs ]
Cap-go
CVEs affecting Cap-go published in the last 30 days, plus any Cap-go CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100629 | 26 Sep 2026 | CVSS 5.5 | Cap-go capgo.appCapgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler… | |
| CVE-2026-100621 | 26 Sep 2026 | CVSS 4.3 | Cap-go capgo.appCapgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of… | |
| CVE-2026-100622 | 26 Sep 2026 | CVSS 7.5 | Cap-go capgo.appcapgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated… | |
| CVE-2026-100623 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCapgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies… | |
| CVE-2026-100624 | 26 Sep 2026 | CVSS 5.4 | Cap-go capgo.appCapgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build… | |
| CVE-2026-100625 | 26 Sep 2026 | CVSS 7.1 | Cap-go capgo.appCapgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a… | |
| CVE-2026-100626 | 26 Sep 2026 | CVSS 4.3 | Cap-go capgo.appcapgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled… | |
| CVE-2026-100627 | 26 Sep 2026 | CVSS 8.1 | Cap-go capgo.appCapgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT… | |
| CVE-2026-100628 | 26 Sep 2026 | CVSS 4.3 | Cap-go capgo.appcapgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey… | |
| CVE-2026-100614 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCapgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable… | |
| CVE-2026-100615 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged… | |
| CVE-2026-100616 | 26 Sep 2026 | CVSS 5.5 | Cap-go capgo.appcapgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the… | |
| CVE-2026-100617 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins… | |
| CVE-2026-100618 | 26 Sep 2026 | CVSS 8.5 | Cap-go capgo.appCapgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value… | |
| CVE-2026-100619 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCapgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be… | |
| CVE-2026-100620 | 26 Sep 2026 | CVSS 3.8 | Cap-go @capgo/cliCapgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding… | |
| CVE-2026-100611 | 26 Sep 2026 | CVSS 6.5 | Cap-go capgo.appCapgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API… | |
| CVE-2026-100612 | 26 Sep 2026 | CVSS 7.2 | Cap-go capgo.appCapgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration… | |
| CVE-2026-100613 | 26 Sep 2026 | CVSS 5.3 | Cap-go capgo.appcapgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at… |