Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

capgo — Vulnerabilities & Security Advisories 99

All 99 CVE vulnerabilities found in capgo, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting the CapGo cloud deployment platform, specifically focusing on software weaknesses and configuration flaws relevant to this vendor. The collection encompasses reported issues ranging from authentication bypasses and remote code execution risks to data exposure incidents, covering the entire period from the product's initial public release through the most recent security updates. Readers can utilize this resource to track official vendor advisories for CapGo, understand the broader implications of specific weakness classes within containerized deployment environments, or review the complete historical vulnerability record for this product to assess long-term security posture. The data presented here is derived from public disclosures, vendor bulletins, and third-party research reports, offering a consolidated view of the security landscape surrounding CapGo without requiring cross-referencing of multiple disparate sources. By examining the trends and severity ratings listed, security professionals and administrators can identify recurring patterns in the platform's codebase, prioritize remediation efforts based on historical data, and make informed decisions regarding the continued use or hardening of their CapGo installations. This aggregation serves as a factual reference for incident response teams, auditors, and developers seeking to maintain the integrity of their cloud infrastructure powered by CapGo.

Vendor: Cap-go

CVE ID Title CVSS Severity Published
CVE-2026-56327 Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC CWE-203 5.3 Medium 2026-06-30
CVE-2026-56320 Capgo - Org/App Scope Mismatch in Device Creation Endpoint CWE-285 7.1 High 2026-06-30
CVE-2026-56318 Capgo - Information Disclosure via /private/validate_password_compliance Endpoint CWE-200 5.3 Medium 2026-06-30
CVE-2026-56300 Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions CWE-200 7.5 High 2026-06-30
CVE-2026-56286 Capgo - Account Deletion Without Password Confirmation CWE-306 8.1 High 2026-06-30
CVE-2026-56249 Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision CWE-285 7.6 High 2026-06-30
CVE-2026-56247 Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment CWE-266 8.8 High 2026-06-30
CVE-2026-56230 Capgo - Broken Object Level Authorization via x-limited-key-id Header CWE-639 8.8 High 2026-06-30
CVE-2026-56233 Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy CWE-22 8.3 High 2026-06-30
CVE-2026-56224 Capgo - Login CSRF and Session Fixation via URL Query Parameters CWE-384 5.4 Medium 2026-06-30
CVE-2026-56219 Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass CWE-287 7.5 High 2026-06-30
CVE-2026-56338 Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint CWE-703 5.3 Medium 2026-06-24
CVE-2026-56337 Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2 CWE-200 5.3 Medium 2026-06-24
CVE-2026-56310 Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass CWE-285 4.3 Medium 2026-06-24
CVE-2026-56302 Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security CWE-284 6.5 Medium 2026-06-24
CVE-2026-56257 Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update CWE-284 7.1 High 2026-06-24
CVE-2026-56256 Capgo - Two-Factor Authentication Bypass via Organization Management API CWE-602 7.1 High 2026-06-24
CVE-2026-56245 Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC CWE-269 8.2 High 2026-06-24
CVE-2026-56244 Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key CWE-200 7.1 High 2026-06-24
CVE-2026-56237 Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation CWE-287 9.1 Critical 2026-06-24
CVE-2026-56231 Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter CWE-285 7.6 High 2026-06-24
CVE-2026-56232 Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header CWE-863 8.8 High 2026-06-24
CVE-2026-56223 Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user CWE-287 8.7 High 2026-06-24
CVE-2026-56322 Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter CWE-200 7.5 High 2026-06-23
CVE-2026-56248 Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy CWE-400 7.5 High 2026-06-23
CVE-2026-56243 Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane CWE-288 8.1 High 2026-06-23
CVE-2026-56234 Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint CWE-307 5.3 Medium 2026-06-23
CVE-2026-56225 Capgo - Authorization Bypass in API Key Management via App-Limited Keys CWE-269 8.3 High 2026-06-23
CVE-2026-56222 Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings CWE-639 7.2 High 2026-06-23
CVE-2026-56323 Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self CWE-200 7.5 High 2026-06-22

All 99 known CVE vulnerabilities affecting capgo with full Chinese analysis, references, and POCs where available.