What’s Vulnerable › Products

Cap-go capgo vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your Cap-go capgo version is affected

Latest Cap-go capgo vulnerabilities

CVE-2026-56339 — Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC (CVSS 7.5)
CVE-2026-56296 — Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC (CVSS 5.3)
CVE-2026-56284 — Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC (CVSS 5.3)
CVE-2026-56226 — Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC (CVSS 7.5)
CVE-2026-56310 — Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass (CVSS 4.3)
CVE-2026-56245 — Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC (CVSS 8.2)
CVE-2026-56248 — Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy (CVSS 7.5)
CVE-2026-56280 — Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect (CVSS 7.1)
CVE-2026-56221 — Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts (CVSS 6.5)
CVE-2026-56316 — Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/* (CVSS 5.3)
CVE-2026-56307 — Cap-go - Broken Cursor Pagination in /private/devices Endpoint (CVSS 4.3)
CVE-2026-56235 — Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions (CVSS 5.3)
CVE-2026-56082 — Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC (CVSS 7.5)
CVE-2026-56081 — Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email (CVSS 9.1)
CVE-2026-56080 — Cap-go - Authentication Logic Flaw in Enforce Password Policy (CVSS 4.9)
CVE-2026-56073 — Cap-go - OTP Bypass via Response Manipulation in Email Verification (CVSS 9.4)
CVE-2026-53982 — Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association (CVSS 6.5)