capgo vulnerabilities

8 known vulnerabilities in capgo from Cap-go. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  capgo: Observable Discrepancy

  CVE-2026-56339Jul 15, 2026Cap-go

  Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function retu

• 7.5 High severity

  capgo: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-56226Jul 8, 2026Cap-go

  Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID

• 8.2 High severity

  capgo: Improper Privilege Management

  CVE-2026-56245Jun 24, 2026Cap-go

  Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/

• 7.5 High severity

  capgo: Uncontrolled Resource Consumption

  CVE-2026-56248Jun 23, 2026Cap-go

  Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner exe

• 7.1 High severity

  capgo: Missing Authorization

  CVE-2026-56280Jun 22, 2026Cap-go

  Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelB

• 7.5 High severity

  capgo: Improper Access Control

  CVE-2026-56082Jun 19, 2026Cap-go

  Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase publishable (sb_publish

• 9.1 Critical severity

  capgo: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2026-56081Jun 19, 2026Cap-go

  Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacke

• 9.4 Critical severity

  capgo: Insufficient Verification of Data Authenticity

  CVE-2026-56073Jun 19, 2026Cap-go

  Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to fals