Cap-go capgo vulnerabilities

Latest Cap-go capgo CVEs

Newest publication first

1. CVE-2026-56339 Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC

   Published 2026-07-15

   High·CVSS 8.7 EPSS 0.36%

   Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error m...

2. CVE-2026-56336 Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint

   Published 2026-07-12

   Medium·CVSS 6.9 EPSS 0.34%

   Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values. Attackers can enumerate email domains to build mappings of domains to organization UUIDs and SSO p...

3. CVE-2026-56281 Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint

   Published 2026-07-12

   Medium·CVSS 5.1 EPSS 0.33%

   Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker...

4. CVE-2026-56296 Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC

   Published 2026-07-11

   Medium·CVSS 6.9 EPSS 0.31%

   Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid app IDs by observing error message differen...

5. CVE-2026-56284 Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC

   Published 2026-07-08

   Medium·CVSS 6.9 EPSS 0.28%

   Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe orga...

6. CVE-2026-56226 Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC

   Published 2026-07-08

   High·CVSS 8.7 EPSS 0.32%

   Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID without verifying it...

7. CVE-2026-56310 Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass

   Published 2026-06-24

   Medium·CVSS 5.3 EPSS 0.23%

   Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limited_to_orgs restrictions. Attackers with org-limited API keys can read membership data including uid, email, image_url, r...

8. CVE-2026-56245 Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC

   Published 2026-06-24

   High·CVSS 8.8 EPSS 0.34%

   Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_...

9. CVE-2026-56223 Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user

   Published 2026-06-24

   Critical·CVSS 9.3 EPSS 0.40%

   Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admi...

10. CVE-2026-56248 Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy

    Published 2026-06-23

    High·CVSS 8.7 EPSS 0.43%

    Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic b...

11. CVE-2026-56280 Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect

    Published 2026-06-22

    High·CVSS 7.1 EPSS 0.32%

    Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() u...

12. CVE-2026-56316 Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*

    Published 2026-06-21

    Medium·CVSS 6.9 EPSS 0.31%

    Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without auth...

13. CVE-2026-56332 Capgo - Open Redirect via confirmation_url Parameter

    Published 2026-06-20

    Medium·CVSS 5.1 EPSS 0.22%

    Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmation_url parameter is not validated, enabling attackers to craft malicious links for phishing and crede...

14. CVE-2026-56307 Cap-go - Broken Cursor Pagination in /private/devices Endpoint

    Published 2026-06-20

    Medium·CVSS 5.3 EPSS 0.28%

    Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can...

15. CVE-2026-56235 Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions

    Published 2026-06-20

    Medium·CVSS 6.9 EPSS 0.35%

    Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) that are granted to the anon role without enforcing org membership or permission checks. An unauthenticated attacker...

16. CVE-2026-56082 Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC

    Published 2026-06-19

    High·CVSS 8.7 EPSS 0.37%

    Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase publishable (sb_publishable_*) anon key. An...

17. CVE-2026-56080 Cap-go - Authentication Logic Flaw in Enforce Password Policy

    Published 2026-06-19

    Medium·CVSS 6.9 EPSS 0.36%

    Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to a compliant one, the backend does not update the password-compliance state. As a result, the backend continues to treat...

18. CVE-2026-56081 Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email

    Published 2026-06-19

    Critical·CVSS 9.3 EPSS 0.43%

    Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over...

19. CVE-2026-56073 Cap-go - OTP Bypass via Response Manipulation in Email Verification

    Published 2026-06-19

    Critical·CVSS 9.3 EPSS 0.23%

    Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verificatio...

20. CVE-2026-53868 Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion

    Published 2026-06-12

    High·CVSS 8.7 EPSS 0.26%

    Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of t...

21. CVE-2026-53867 Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement

    Published 2026-06-12

    Medium·CVSS 5.3 EPSS 0.18%

    Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.

22. CVE-2026-53982 Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association

    Published 2026-06-12

    High·CVSS 7.1 EPSS 0.33%

    Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session. The platform incorre...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.