These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-56336 is an information disclosure vulnerability in Capgo's unauthenticated /private/sso/check-domain endpoint. The vulnerability returns internal org_id and provider_id values, allowing attackers to enumerate email domains and build mappings of domains to organization UUIDs and SSO provider identifiers. This information can be used by attackers to gather information about Capgo tenants, which co [truncated]
CVE-2026-56313 is a high-severity vulnerability in Capgo, a tool used for managing applications. The vulnerability exists in the SSO prelink endpoint and allows an attacker with 'org.update_settings' permission and an active SSO provider to disrupt accounts across different organizations. Specifically, an attacker can permanently remove email-based authentication for users in foreign organizations matchin [truncated]
CVE-2026-56308 is a high-severity vulnerability in Capgo, a product that allows email address changes without requiring current password re-authentication or verification of the existing email. This issue can allow an attacker with access to a valid session cookie or authenticated browser to change the account email, potentially gaining control of account recovery and bypassing multi-factor authentication [truncated]
CVE-2026-56281 is a SQL injection vulnerability in Capgo before 12.128.2. The vulnerability exists in the POST /private/admin_stats endpoint, where the limit parameter is destructured from an unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas [truncated]
A scope isolation vulnerability was discovered in Capgo's POST /webhooks/test endpoint. This vulnerability allows app-scoped API keys to invoke org-scoped webhook operations, potentially bypassing authorization checks. The vulnerability has a CVSS score of 5.3, indicating a medium severity. Users of Capgo, especially those with app-scoped credentials, should be aware of this vulnerability and take necessa [truncated]
CVE-2026-56241 is a high-severity privilege escalation vulnerability in Capgo. The issue arises from demoted super_admin users retaining access to certain RPCs due to a stale org_users.user_right column not being cleared during role binding deletion. This allows attackers with a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.
CVE-2026-56238 is an information disclosure vulnerability in Capgo's Supabase PostgREST global_stats endpoint. Unauthenticated attackers can exploit this to read sensitive financial and operational metrics, including MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry. This vulnerability has a CVSS score of 8.7 and is considered HIGH severity. Users of Capgo, especi [truncated]
CVE-2026-56303 is an information disclosure vulnerability in Capgo before 12.128.2. The vulnerability is located in the find_apikey_by_value PostgreSQL function, which is marked SECURITY DEFINER and executable by the anon role. This allows unauthenticated attackers to call this function via the /rest/v1/rpc/find_apikey_by_value endpoint to retrieve sensitive API key metadata, including user_id, mode, org [truncated]
CVE-2026-56240 is a medium-severity vulnerability in Capgo that allows organizations with exhausted or expired usage credit grants to bypass billing gates. The vulnerability is caused by a divergence between the plugin hot-path plan_valid expression and the authoritative billing gate. This bypass enables continued access to /updates, /stats, /channel_self, and attachment upload endpoints after credit depl [truncated]
CVE-2026-56335 is an authorization bypass vulnerability in Capgo before 12.128.2. The vulnerability allows write-scoped API keys to directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive channel attributes such as public, allow_emulator, and security-related flags out [truncated]
A medium-severity vulnerability, CVE-2026-56329, was found in Capgo, a cross-tenant preview namespace collision issue. This vulnerability is caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim application [truncated]
CVE-2026-56312 is an improper validation vulnerability in Capgo's accept_invitation endpoint. The issue allows attackers to bypass captcha protection by creating user accounts with invalid captcha tokens, potentially leading to unwanted accounts and burned invite links. This vulnerability affects Capgo versions before 12.128.2 and has a CVSS score of 6.9, indicating a medium severity. Developers and admin [truncated]
Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. This vulnerability enables storage and bandwidth abuse through arbitrary attachment uploads using upload-scoped API keys that bypass plan checks. These attachments persist outside normal bundle metadata and survive app deletion. Users [truncated]
CVE-2026-56305 is an authentication bypass vulnerability in Capgo before version 12.128.2. The vulnerability exists in the password change endpoint and allows attackers to change user passwords without requiring current password confirmation. This flaw can be exploited by attackers with temporary session access to permanently lock out legitimate users and achieve full account takeover. The vulnerability h [truncated]
CVE-2026-56279 is an information disclosure vulnerability in Capgo before 12.128.2. The vulnerability is located in the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata. This vulnerability al [truncated]
The CVE record was published on 2026-07-08T14:17:16.493Z and has not been modified since then. The NVD entry is currently Deferred. This vulnerability affects Capgo versions before 12.128.2, allowing attackers to extract geographic location information and other embedded metadata from uploaded files. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Users of Capgo versions before 12.128. [truncated]
CVE-2026-56283 is an HTML injection vulnerability in the organization settings endpoint of Capgo, a product from an unknown vendor. The vulnerability allows attackers to inject malicious HTML content, potentially leading to phishing attacks and reputational damage. The issue was publicly disclosed on 2026-07-08T14:17:15.970Z and last modified on 2026-07-08T15:16:30.887Z. The vulnerability exists in the or [truncated]
CVE-2026-56250 is a high-severity vulnerability in Capgo, a platform that allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST. This enables retargeting to arbitrary R2 bundle objects, potentially causing denial of service and bundle availability disruption. The vulnerability has a CVSS score of 8.7 and is considered High severity. Users of Capgo versions before [truncated]
CVE-2026-56246 is a high-severity vulnerability in Capgo, a platform that enables developers to manage and deploy their applications. The vulnerability, with a CVSS score of 7.2, is caused by a broken access control mechanism in the organization management API. Specifically, a scoped API key limited to a specific organization can still perform destructive operations on another organization if the key's ow [truncated]
CVE-2026-56220 is an authorization bypass vulnerability in Capgo before version 12.128.2. The vulnerability exists in the public.manifest INSERT policy, allowing read-only org members to insert OTA manifest rows. This could enable attackers with read-only org access to inject malicious manifest entries with arbitrary s3_path values, served to devices via the unauthenticated /updates endpoint. This could l [truncated]
CVE-2026-56217 is a policy bypass vulnerability in Capgo app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. This vulnerability affects Capgo users with app-scoped API keys, potentially weakening OTA security controls. The vulnerability has a CVSS score of 5.3 and is considered Medium priority.
CVE-2026-56243 is a security control bypass vulnerability in Capgo before 12.128.2. The PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. This allows attackers to bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources. The vulnerability has a CVSS score of [truncated]
CVE-2026-56234 is a credential validation vulnerability in Capgo, a vulnerability that allows attackers to perform password spraying and credential stuffing attacks. The vulnerability exists in the POST /functions/v1/private/validate_password_compliance endpoint, which is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and [truncated]
CVE-2026-56225 is an authorization bypass vulnerability in Capgo's public API key management handlers (get/put/delete/post). API keys created with mode=all but restricted to a single app via limited_to_apps are only checked for limited_to_orgs and not for limited_to_apps, allowing an app-scoped key to enumerate, update, and delete sibling API keys belonging to the same account that are outside its declare [truncated]
CVE-2026-56222 is an authorization bypass vulnerability in Capgo before 12.128.2. The vulnerability is located in the POST /private/role_bindings endpoint, which fails to verify app_id ownership during app-scoped role binding creation. This allows an attacker with administrative privileges in one organization to create role bindings targeting applications owned by other organizations. As a result, the att [truncated]
CVE-2026-56314 is a high-severity vulnerability in Capgo, a mobile app management platform. The issue arises from the platform's failure to filter deleted app versions when joining channels during the /updates resolution process. This oversight allows deleted bundles to remain selectable, enabling attackers to deploy them to devices. The vulnerability has a CVSS score of 7.1 and is considered high severit [truncated]
CVE-2026-56311 is a medium-severity vulnerability in Capgo, a cloud-based service, that allows unauthenticated attackers to bypass authorization and retrieve organization plan limits. The vulnerability is located in the public.get_current_plan_max_org RPC function. Attackers can exploit this vulnerability by calling the RPC endpoint with any organization UUID and the public Supabase key to disclose sensit [truncated]
CVE-2026-56306 is a medium-severity vulnerability in Capgo, a product of Unknown Vendor, which has a weak parsing vulnerability in the x-limited-key-id header. This vulnerability allows remote attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. As a result, attackers can manipulate the x-limited-key-id header to disable limi [truncated]
CVE-2026-56255 is a denial of service vulnerability in Capgo before version 12.128.2. The vulnerability exists in the POST /app/demo endpoint and allows authenticated users with org write permissions to create unlimited demo applications without rate limiting or quota enforcement. This can lead to approximately 138 database write operations per request, causing degraded performance, increased costs, and p [truncated]
CVE-2026-56299 is a medium-severity authentication bypass vulnerability in Capgo before 12.128.2. The issue allows unauthenticated attackers to send OPTIONS requests to the /build/upload/:jobId/* endpoint, bypassing authentication middleware and invoking tusProxy logic with invalid credentials. This enables trivial request flooding and denial of service (DoS) attacks. The vulnerability has a CVSS score of [truncated]