CVE-2026-56321— Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint

Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint

Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST and DELETE role_bindings routes, so unauthenticated requests reach the handler instead of being rejected at the middleware layer. The handler still performs its own authorization check and returns Unauthorized, so no direct data exposure occurs; the flaw is inconsistent authentication enforcement across HTTP methods that could enable authorization bypass if the handler logic changes.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

关键功能的认证机制缺失

Capgo 授权问题漏洞

Capgo是CAPGO公司的一个专为CapacitorJS开发者打造的移动应用开发和更新平台。 Capgo 12.128.2之前版本存在授权问题漏洞，该漏洞源于未对GET /private/role_bindings/:org_id端点应用全局身份验证中间件，导致身份验证执行不一致，如果处理逻辑发生变化，可能造成授权绕过。

N/A

N/A