These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-56336 is an information disclosure vulnerability in Capgo's unauthenticated /private/sso/check-domain endpoint. The vulnerability returns internal org_id and provider_id values, allowing attackers to enumerate email domains and build mappings of domains to organization UUIDs and SSO provider identifiers. This information can be used by attackers to gather information about Capgo tenants, which co [truncated]
CVE-2026-56313 is a high-severity vulnerability in Capgo, a tool used for managing applications. The vulnerability exists in the SSO prelink endpoint and allows an attacker with 'org.update_settings' permission and an active SSO provider to disrupt accounts across different organizations. Specifically, an attacker can permanently remove email-based authentication for users in foreign organizations matchin [truncated]
CVE-2026-56308 is a high-severity vulnerability in Capgo, a product that allows email address changes without requiring current password re-authentication or verification of the existing email. This issue can allow an attacker with access to a valid session cookie or authenticated browser to change the account email, potentially gaining control of account recovery and bypassing multi-factor authentication [truncated]
CVE-2026-56281 is a SQL injection vulnerability in Capgo before 12.128.2. The vulnerability exists in the POST /private/admin_stats endpoint, where the limit parameter is destructured from an unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas [truncated]
A scope isolation vulnerability was discovered in Capgo's POST /webhooks/test endpoint. This vulnerability allows app-scoped API keys to invoke org-scoped webhook operations, potentially bypassing authorization checks. The vulnerability has a CVSS score of 5.3, indicating a medium severity. Users of Capgo, especially those with app-scoped credentials, should be aware of this vulnerability and take necessa [truncated]
CVE-2026-56241 is a high-severity privilege escalation vulnerability in Capgo. The issue arises from demoted super_admin users retaining access to certain RPCs due to a stale org_users.user_right column not being cleared during role binding deletion. This allows attackers with a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.
CVE-2026-56238 is an information disclosure vulnerability in Capgo's Supabase PostgREST global_stats endpoint. Unauthenticated attackers can exploit this to read sensitive financial and operational metrics, including MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry. This vulnerability has a CVSS score of 8.7 and is considered HIGH severity. Users of Capgo, especi [truncated]
CVE-2026-56303 is an information disclosure vulnerability in Capgo before 12.128.2. The vulnerability is located in the find_apikey_by_value PostgreSQL function, which is marked SECURITY DEFINER and executable by the anon role. This allows unauthenticated attackers to call this function via the /rest/v1/rpc/find_apikey_by_value endpoint to retrieve sensitive API key metadata, including user_id, mode, org [truncated]
CVE-2026-56240 is a medium-severity vulnerability in Capgo that allows organizations with exhausted or expired usage credit grants to bypass billing gates. The vulnerability is caused by a divergence between the plugin hot-path plan_valid expression and the authoritative billing gate. This bypass enables continued access to /updates, /stats, /channel_self, and attachment upload endpoints after credit depl [truncated]
CVE-2026-56335 is an authorization bypass vulnerability in Capgo before 12.128.2. The vulnerability allows write-scoped API keys to directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive channel attributes such as public, allow_emulator, and security-related flags out [truncated]
A medium-severity vulnerability, CVE-2026-56329, was found in Capgo, a cross-tenant preview namespace collision issue. This vulnerability is caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim application [truncated]
CVE-2026-56312 is an improper validation vulnerability in Capgo's accept_invitation endpoint. The issue allows attackers to bypass captcha protection by creating user accounts with invalid captcha tokens, potentially leading to unwanted accounts and burned invite links. This vulnerability affects Capgo versions before 12.128.2 and has a CVSS score of 6.9, indicating a medium severity. Developers and admin [truncated]
Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. This vulnerability enables storage and bandwidth abuse through arbitrary attachment uploads using upload-scoped API keys that bypass plan checks. These attachments persist outside normal bundle metadata and survive app deletion. Users [truncated]
CVE-2026-56305 is an authentication bypass vulnerability in Capgo before version 12.128.2. The vulnerability exists in the password change endpoint and allows attackers to change user passwords without requiring current password confirmation. This flaw can be exploited by attackers with temporary session access to permanently lock out legitimate users and achieve full account takeover. The vulnerability h [truncated]
CVE-2026-56279 is an information disclosure vulnerability in Capgo before 12.128.2. The vulnerability is located in the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata. This vulnerability al [truncated]
The CVE record was published on 2026-07-08T14:17:16.493Z and has not been modified since then. The NVD entry is currently Deferred. This vulnerability affects Capgo versions before 12.128.2, allowing attackers to extract geographic location information and other embedded metadata from uploaded files. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Users of Capgo versions before 12.128. [truncated]
CVE-2026-56283 is an HTML injection vulnerability in the organization settings endpoint of Capgo, a product from an unknown vendor. The vulnerability allows attackers to inject malicious HTML content, potentially leading to phishing attacks and reputational damage. The issue was publicly disclosed on 2026-07-08T14:17:15.970Z and last modified on 2026-07-08T15:16:30.887Z. The vulnerability exists in the or [truncated]
CVE-2026-56250 is a high-severity vulnerability in Capgo, a platform that allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST. This enables retargeting to arbitrary R2 bundle objects, potentially causing denial of service and bundle availability disruption. The vulnerability has a CVSS score of 8.7 and is considered High severity. Users of Capgo versions before [truncated]
CVE-2026-56246 is a high-severity vulnerability in Capgo, a platform that enables developers to manage and deploy their applications. The vulnerability, with a CVSS score of 7.2, is caused by a broken access control mechanism in the organization management API. Specifically, a scoped API key limited to a specific organization can still perform destructive operations on another organization if the key's ow [truncated]
CVE-2026-56220 is an authorization bypass vulnerability in Capgo before version 12.128.2. The vulnerability exists in the public.manifest INSERT policy, allowing read-only org members to insert OTA manifest rows. This could enable attackers with read-only org access to inject malicious manifest entries with arbitrary s3_path values, served to devices via the unauthenticated /updates endpoint. This could l [truncated]
CVE-2026-56217 is a policy bypass vulnerability in Capgo app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. This vulnerability affects Capgo users with app-scoped API keys, potentially weakening OTA security controls. The vulnerability has a CVSS score of 5.3 and is considered Medium priority.
CVE-2026-56243 is a security control bypass vulnerability in Capgo before 12.128.2. The PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. This allows attackers to bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources. The vulnerability has a CVSS score of [truncated]
CVE-2026-56234 is a credential validation vulnerability in Capgo, a vulnerability that allows attackers to perform password spraying and credential stuffing attacks. The vulnerability exists in the POST /functions/v1/private/validate_password_compliance endpoint, which is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and [truncated]
CVE-2026-56225 is an authorization bypass vulnerability in Capgo's public API key management handlers (get/put/delete/post). API keys created with mode=all but restricted to a single app via limited_to_apps are only checked for limited_to_orgs and not for limited_to_apps, allowing an app-scoped key to enumerate, update, and delete sibling API keys belonging to the same account that are outside its declare [truncated]
CVE-2026-56222 is an authorization bypass vulnerability in Capgo before 12.128.2. The vulnerability is located in the POST /private/role_bindings endpoint, which fails to verify app_id ownership during app-scoped role binding creation. This allows an attacker with administrative privileges in one organization to create role bindings targeting applications owned by other organizations. As a result, the att [truncated]
CVE-2026-56314 is a high-severity vulnerability in Capgo, a mobile app management platform. The issue arises from the platform's failure to filter deleted app versions when joining channels during the /updates resolution process. This oversight allows deleted bundles to remain selectable, enabling attackers to deploy them to devices. The vulnerability has a CVSS score of 7.1 and is considered high severit [truncated]
CVE-2026-56311 is a medium-severity vulnerability in Capgo, a cloud-based service, that allows unauthenticated attackers to bypass authorization and retrieve organization plan limits. The vulnerability is located in the public.get_current_plan_max_org RPC function. Attackers can exploit this vulnerability by calling the RPC endpoint with any organization UUID and the public Supabase key to disclose sensit [truncated]
CVE-2026-56306 is a medium-severity vulnerability in Capgo, a product of Unknown Vendor, which has a weak parsing vulnerability in the x-limited-key-id header. This vulnerability allows remote attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. As a result, attackers can manipulate the x-limited-key-id header to disable limi [truncated]
CVE-2026-56255 is a denial of service vulnerability in Capgo before version 12.128.2. The vulnerability exists in the POST /app/demo endpoint and allows authenticated users with org write permissions to create unlimited demo applications without rate limiting or quota enforcement. This can lead to approximately 138 database write operations per request, causing degraded performance, increased costs, and p [truncated]
CVE-2026-56299 is a medium-severity authentication bypass vulnerability in Capgo before 12.128.2. The issue allows unauthenticated attackers to send OPTIONS requests to the /build/upload/:jobId/* endpoint, bypassing authentication middleware and invoking tusProxy logic with invalid credentials. This enables trivial request flooding and denial of service (DoS) attacks. The vulnerability has a CVSS score of [truncated]
CVE-2026-56253 is a high-severity vulnerability in Capgo, a product of unknown vendor, that allows unauthenticated attackers to enumerate organization members. The vulnerability exists in the public.get_org_members RPC function and can be exploited using only the public sb_publishable_* key and an organization UUID. This exposure can lead to the retrieval of sensitive member information, including email a [truncated]
CVE-2026-56251 is a HIGH-severity vulnerability in Capgo before version 12.128.2. The issue is a broken row-level security policy in the org_users table, which allows authenticated users to elevate privileges from admin to super_admin. This could lead to unauthorized access and compromise system security. Organizations using affected Capgo versions should prioritize patching to limit exposure.
CVE-2026-56242 is a HIGH-severity vulnerability in Capgo, a product with an unauthenticated security definer RPC function get_identity_apikey_only. This function returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. The vulnerability allows attackers to confirm key validity and map keys to user identifiers, potentially leading to furt [truncated]
CVE-2026-56236 is a medium-severity vulnerability in Capgo CLI versions before 12.128.2. The vulnerability allows attackers to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI. The issue arises from the CLI's handling of symlinks in repositories without proper validation. This vulnerability has a CVSS score of 6.8 and is classified as CWE-59. Orga [truncated]
CVE-2026-56229 is a high-severity authorization bypass vulnerability in Capgo, a mobile app development platform. The vulnerability exists in the /build/status and /build/logs endpoints, allowing attackers to access build jobs belonging to different applications by supplying a mismatched app_id and job_id combination. This issue affects Capgo versions before 12.128.2. Defenders should prioritize patching [truncated]
CVE-2026-56332 is a medium-severity open redirect vulnerability in Capgo before version 12.128.2. The vulnerability exists in the confirm-signup endpoint and allows attackers to redirect users to arbitrary external websites. This is possible because the confirmation_url parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting attacks. Organizations usi [truncated]
CVE-2026-56330 is a medium-severity open redirect vulnerability in Capgo before version 12.128.2. The vulnerability affects the stripe_portal and stripe_checkout endpoints, which accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. This allows authenticated attackers to craft malicious billing URLs that can redirect users to attacker-controlled domains for phishing and credential harvesti [truncated]
CVE-2026-56325 is a low-severity vulnerability in Capgo before 12.128.2. The issue arises from the use of ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver. This allows attackers to create apps with app_ids differing by one character at underscore positions, potentially causing unintended pattern matches. This could break preview functionality for legitim [truncated]
CVE-2026-56319 is a medium-severity information disclosure vulnerability in Capgo before 12.128.2. The vulnerability exists in the GET /statistics/app/:app_id endpoint, enabling app-limited API keys to differentiate between existing and non-existent sibling app IDs through distinct error responses. This issue compromises tenant isolation, allowing attackers to enumerate real app IDs outside their permitte [truncated]
CVE-2026-56282 is a medium-severity information disclosure vulnerability in Capgo before version 12.128.2. The vulnerability exists in the unauthenticated /replication endpoint, exposing internal PostgreSQL replication telemetry, including slot names and WAL LSN positions. This allows attackers to retrieve sensitive infrastructure details without authentication, which can be used for reconnaissance purpos [truncated]
CVE-2026-56228 is a medium-severity vulnerability in Capgo, a mobile app development platform. An authenticated organization administrator can set an extremely large numeric value as the minimum password length, causing an organization-wide account lockout and application-level denial of service. This issue was reported on June 20, 2026, and patched in version 12.128.2. The vulnerability has a CVSS score [truncated]
CVE-2026-56227 is a medium-severity server-side request forgery (SSRF) vulnerability in Capgo versions before 12.128.2. The issue arises from inadequate webhook URL validation, permitting organization admins to configure webhooks pointing to localhost or 127.0.0.1. When triggered, the backend performs outbound requests to these addresses, disclosing error responses to users. Defenders should assess their [truncated]
CVE-2026-56215 is a high-severity vulnerability in Capgo, a platform that allows authenticated users to modify their public.users.email field to arbitrary addresses. This issue enables attackers to pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.
CVE-2026-53868 is a high-severity denial of service vulnerability in Capgo, a platform that allows attackers to register accounts using arbitrary email addresses without verification. By initiating deletion, attackers can lock emails in a pending deletion state, permanently locking legitimate users out of the platform for 30 days. This vulnerability has a CVSS score of 8.7 and is considered HIGH severity.