Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

capgo — Vulnerabilities & Security Advisories 99

All 99 CVE vulnerabilities found in capgo, with AI-generated Chinese analysis, references, and POCs.

This page is a vulnerability aggregation resource for the capgo product, categorized under software development tools and tagged with mobile application security weaknesses. It compiles a comprehensive list of known security flaws affecting capgo, covering historical data from its initial release through the most recent advisories issued by the vendor. This collection includes critical, high, and medium severity issues that impact the integrity, confidentiality, and availability of applications utilizing the capgo platform. Users can discover essential insights by tracking a vendor's advisories to stay informed about emerging risks, understanding a specific weakness class to better grasp the underlying technical mechanisms of the flaws, and looking up a product's vulnerability history to assess long-term security posture. The aggregated data aims to provide developers, security analysts, and product managers with a clear view of the attack surface associated with capgo. By reviewing the consolidated findings, stakeholders can prioritize patching efforts, improve code review processes, and enhance overall application security practices. This resource serves as a central reference point for evaluating the reliability of the capgo library in production environments. It facilitates informed decision-making regarding version upgrades and dependency management. The page focuses on factual reporting and technical analysis rather than promotional content. Readers are encouraged to use the information for defensive purposes and to integrate these findings into their continuous integration and deployment pipelines for robust security assurance.

Vendor: Cap-go

CVE ID Title CVSS Severity Published
CVE-2026-56339 Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC CWE-203 7.5 High 2026-07-15
CVE-2026-56336 Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint CWE-200 5.3 Medium 2026-07-12
CVE-2026-56313 Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint CWE-285 8.1 High 2026-07-12
CVE-2026-56308 Capgo - Insufficient Authentication in Email Change Endpoint CWE-640 7.3 High 2026-07-12
CVE-2026-56281 Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint CWE-89 3.8 Low 2026-07-12
CVE-2026-56252 Capgo - Scope Isolation Failure in Webhook Test Endpoint CWE-863 5.4 Medium 2026-07-12
CVE-2026-56241 Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right CWE-285 8.3 High 2026-07-12
CVE-2026-56238 Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint CWE-200 7.5 High 2026-07-12
CVE-2026-56303 Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function CWE-200 7.5 High 2026-07-11
CVE-2026-56296 Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC CWE-203 5.3 Medium 2026-07-11
CVE-2026-56240 Capgo - Billing Authorization Bypass via Exhausted Usage Credits CWE-285 4.3 Medium 2026-07-11
CVE-2026-56335 Capgo - Channel Configuration Mutation via Write-Scoped API Keys CWE-284 6.5 Medium 2026-07-10
CVE-2026-56329 Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding CWE-436 6.4 Medium 2026-07-10
CVE-2026-56312 Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint CWE-287 6.5 Medium 2026-07-10
CVE-2026-56309 Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint CWE-770 5.4 Medium 2026-07-10
CVE-2026-56305 Capgo - Authentication Bypass in Password Change via Missing Current Password Validation CWE-620 8.3 High 2026-07-10
CVE-2026-56279 Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint CWE-862 7.5 High 2026-07-10
CVE-2026-56298 Capgo - EXIF Metadata Exposure in App Information Image Upload CWE-200 4.3 Medium 2026-07-08
CVE-2026-56293 Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app() CWE-285 5.4 Medium 2026-07-08
CVE-2026-56284 Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC CWE-200 5.3 Medium 2026-07-08
CVE-2026-56283 Capgo - HTML Injection Leading to Open Redirection in Organization Settings CWE-79 5.4 Medium 2026-07-08
CVE-2026-56250 Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions CWE-862 7.5 High 2026-07-08
CVE-2026-56246 Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance CWE-285 8.1 High 2026-07-08
CVE-2026-56226 Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC CWE-200 7.5 High 2026-07-08
CVE-2026-56220 Capgo - Unauthorized Manifest Insertion via Read-Only Org Member CWE-863 6.5 Medium 2026-07-08
CVE-2026-56217 Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update CWE-284 4.3 Medium 2026-07-08
CVE-2026-56334 Capgo - Missing UPDATE RLS Policy for Build Status Persistence CWE-284 4.3 Medium 2026-06-30
CVE-2026-56331 Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String CWE-209 5.3 Medium 2026-06-30
CVE-2026-56333 Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates CWE-20 4.3 Medium 2026-06-30
CVE-2026-56328 Capgo - Integrity Issue in Release Routing via Multiple Public Channels CWE-670 6.5 Medium 2026-06-30

All 99 known CVE vulnerabilities affecting capgo with full Chinese analysis, references, and POCs where available.