cap-go capgo Vulnerabilities

cap-go capgo has 103 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 90 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting cap-go capgo, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

• Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC

  CVE-2026-56339

  Public exploit

  Patch

  CWE-203
  High · CVSS 8.7

  EPSS 0.3% (20th pct) · 2026-07-15
• Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint

  CVE-2026-56336

  Public exploit

  Patch

  CWE-200
  Medium · CVSS 6.9

  EPSS 0.2% (11th pct) · 2026-07-12
• Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint

  CVE-2026-56313

  Patch

  CWE-285
  High · CVSS 7.2

  EPSS 0.3% (20th pct) · 2026-07-12
• Capgo - Insufficient Authentication in Email Change Endpoint

  CVE-2026-56308

  Public exploit

  Patch

  CWE-640
  High · CVSS 8.4

  EPSS 0.2% (16th pct) · 2026-07-12
• Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint

  CVE-2026-56281

  Public exploit

  Patch

  CWE-89
  Medium · CVSS 5.1

  EPSS 0.2% (10th pct) · 2026-07-12
• Capgo - Scope Isolation Failure in Webhook Test Endpoint

  CVE-2026-56252

  Public exploit

  Patch

  CWE-863
  Medium · CVSS 5.3

  EPSS 0.2% (7th pct) · 2026-07-12
• Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right

  CVE-2026-56241

  Public exploit

  Patch

  CWE-285
  High · CVSS 7.2

  EPSS 0.2% (11th pct) · 2026-07-12
• Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint

  CVE-2026-56238

  Public exploit

  Patch

  CWE-200
  High · CVSS 8.7

  EPSS 0.4% (29th pct) · 2026-07-12
• Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function

  CVE-2026-56303

  Public exploit

  Patch

  CWE-200
  High · CVSS 8.7

  EPSS 0.3% (22th pct) · 2026-07-11
• Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC

  CVE-2026-56296

  Public exploit

  Patch

  CWE-203
  Medium · CVSS 6.9

  EPSS 0.2% (15th pct) · 2026-07-11
• Capgo - Billing Authorization Bypass via Exhausted Usage Credits

  CVE-2026-56240

  Public exploit

  Patch

  CWE-285
  Medium · CVSS 5.3

  EPSS 0.2% (8th pct) · 2026-07-11
• Capgo - Channel Configuration Mutation via Write-Scoped API Keys

  CVE-2026-56335

  Public exploit

  Patch

  CWE-284
  High · CVSS 7.1

  EPSS 0.3% (22th pct) · 2026-07-10
• Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding

  CVE-2026-56329

  Public exploit

  Patch

  CWE-436
  Medium · CVSS 5.3

  EPSS 0.2% (15th pct) · 2026-07-10
• Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint

  CVE-2026-56312

  Patch

  CWE-287
  Medium · CVSS 6.9

  EPSS 0.3% (20th pct) · 2026-07-10
• Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint

  CVE-2026-56309

  Public exploit

  Patch

  CWE-770
  Medium · CVSS 5.3

  EPSS 0.3% (18th pct) · 2026-07-10
• Capgo - Authentication Bypass in Password Change via Missing Current Password Validation

  CVE-2026-56305

  Public exploit

  Patch

  CWE-620
  High · CVSS 8.7

  EPSS 0.4% (28th pct) · 2026-07-10
• Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint

  CVE-2026-56279

  Public exploit

  Patch

  CWE-862
  High · CVSS 8.7

  EPSS 0.3% (24th pct) · 2026-07-10
• capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution

  CVE-2026-56254

  Patch

  CWE-320
  High · CVSS 8.3

  EPSS 0.2% (5th pct) · 2026-07-10
• Capgo - EXIF Metadata Exposure in App Information Image Upload

  CVE-2026-56298

  Patch

  CWE-200
  Medium · CVSS 5.3

  EPSS 0.2% (9th pct) · 2026-07-08
• Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()

  CVE-2026-56293

  Public exploit

  Patch

  CWE-285
  Medium · CVSS 5.3

  EPSS 0.1% (4th pct) · 2026-07-08
• Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC

  CVE-2026-56284

  Public exploit

  Patch

  CWE-200
  Medium · CVSS 6.9

  EPSS 0.2% (12th pct) · 2026-07-08
• Capgo - HTML Injection Leading to Open Redirection in Organization Settings

  CVE-2026-56283

  Public exploit

  Patch

  CWE-79
  Medium · CVSS 4.8

  EPSS 0.1% (4th pct) · 2026-07-08
• Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions

  CVE-2026-56250

  Public exploit

  Patch

  CWE-862
  High · CVSS 8.7

  EPSS 0.3% (17th pct) · 2026-07-08
• Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance

  CVE-2026-56246

  Public exploit

  Patch

  CWE-285
  High · CVSS 7.2

  EPSS 0.2% (13th pct) · 2026-07-08
• Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC

  CVE-2026-56226

  Public exploit

  Patch

  CWE-200
  High · CVSS 8.7

  EPSS 0.3% (17th pct) · 2026-07-08
• Capgo - Unauthorized Manifest Insertion via Read-Only Org Member

  CVE-2026-56220

  Public exploit

  Patch

  CWE-863
  High · CVSS 7.1

  EPSS 0.2% (10th pct) · 2026-07-08
• Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update

  CVE-2026-56217

  Public exploit

  Patch

  CWE-284
  Medium · CVSS 5.3

  EPSS 0.2% (12th pct) · 2026-07-08
• Capgo - Missing UPDATE RLS Policy for Build Status Persistence

  CVE-2026-56334

  Public exploit

  Patch

  CWE-284
  Medium · CVSS 5.3

  EPSS 0.2% (9th pct) · 2026-06-30
• Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates

  CVE-2026-56333

  Public exploit

  Patch

  CWE-20
  Medium · CVSS 5.3

  EPSS 0.2% (15th pct) · 2026-06-30
• Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String

  CVE-2026-56331

  Public exploit

  Patch

  CWE-209
  Medium · CVSS 6.9

  EPSS 0.3% (16th pct) · 2026-06-30