What’s Vulnerable › Products
Cap-go capgo.app vulnerabilities
23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.
Check whether your Cap-go capgo.app version is affected
Latest Cap-go capgo.app vulnerabilities
- CVE-2026-100629 — Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH (CVSS 5.5)
- CVE-2026-100628 — capgo.app before 12.128.12 Authentication Bypass via apikey (CVSS 4.3)
- CVE-2026-100627 — Capgo bundle promotion API channel RBAC deny override bypass (CVSS 8.1)
- CVE-2026-100626 — capgo through 12.128.2 IDOR via PUT /app icon endpoint (CVSS 4.3)
- CVE-2026-100625 — Capgo Build Upload Proxy Authorization Bypass via TUS Resource (CVSS 7.1)
- CVE-2026-100624 — Capgo.app before 12.264.5 Upload Expiry Bypass via build upload (CVSS 5.4)
- CVE-2026-100623 — Capgo Authentication Bypass via Direct PostgREST org_users Table Write (CVSS 8.8)
- CVE-2026-100622 — capgo.app through 12.129.0 Cache Restoration of Deleted Bundles (CVSS 7.5)
- CVE-2026-100621 — capgo.app Content-Lock Bypass via r2-direct Bundle Mutation (CVSS 4.3)
- CVE-2026-100619 — Capgo OTA Manifest Poisoning via app_versions.manifest Bypass (CVSS 8.8)
- CVE-2026-100618 — Capgo App Icon Update Privilege Escalation via Service-Role Worker (CVSS 8.5)
- CVE-2026-100617 — Cap-go capgo.app Authorization Bypass via channel_permission_overrides (CVSS 8.8)
- CVE-2026-100616 — capgo.app Authentication Bypass via PostgREST customer_id Mutation (CVSS 5.5)
- CVE-2026-100615 — Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation (CVSS 8.8)
- CVE-2026-100614 — Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker (CVSS 8.8)
- CVE-2026-100613 — capgo.app Authorization Bypass via Stale Channel Permission Overrides (CVSS 5.3)
- CVE-2026-100612 — Capgo SSO Provider ID Authentication Bypass via Incomplete Migration (CVSS 7.2)
- CVE-2026-100611 — Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list (CVSS 6.5)
- CVE-2026-88864 — Capgo SSO Provider Authentication Bypass via PostgREST Direct Write (CVSS 9.1)
- CVE-2026-88863 — capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org (CVSS 8.1)
- CVE-2026-88862 — Capgo API Key Manager Authentication Bypass via x-limited-key-id (CVSS 8.8)
- CVE-2026-88861 — Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization (CVSS 8.3)
- CVE-2026-88860 — Capgo Authorization Bypass via Stale Channel Permission Overrides (CVSS 6.3)