# Capgo.

Every CVE that names Capgo among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint](https://agentprime.io/advisories/CVE-2026-56336.md)
  `CVE-2026-56336` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Information disclosure
- [Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint](https://agentprime.io/advisories/CVE-2026-56313.md)
  `CVE-2026-56313` · CVE record: Capgo Capgo · CVSS 7.2 High · Not analysed yet · Published 12 Jul 2026 · Tags: Broken access control
- [Capgo - Insufficient Authentication in Email Change Endpoint](https://agentprime.io/advisories/CVE-2026-56308.md)
  `CVE-2026-56308` · CVE record: Capgo Capgo · CVSS 8.4 High · Not analysed yet · Published 12 Jul 2026 · Tags: CWE-640
- [Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint](https://agentprime.io/advisories/CVE-2026-56281.md)
  `CVE-2026-56281` · CVE record: Capgo Capgo · CVSS 5.1 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: SQL injection
- [Capgo - Scope Isolation Failure in Webhook Test Endpoint](https://agentprime.io/advisories/CVE-2026-56252.md)
  `CVE-2026-56252` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Broken access control
- [Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right](https://agentprime.io/advisories/CVE-2026-56241.md)
  `CVE-2026-56241` · CVE record: Capgo Capgo · CVSS 7.2 High · Not analysed yet · Published 12 Jul 2026 · Tags: Broken access control
- [Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint](https://agentprime.io/advisories/CVE-2026-56238.md)
  `CVE-2026-56238` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 12 Jul 2026 · Tags: Information disclosure
- [Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function](https://agentprime.io/advisories/CVE-2026-56303.md)
  `CVE-2026-56303` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 11 Jul 2026 · Tags: Information disclosure
- [Capgo - Billing Authorization Bypass via Exhausted Usage Credits](https://agentprime.io/advisories/CVE-2026-56240.md)
  `CVE-2026-56240` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 11 Jul 2026 · Tags: Broken access control
- [Capgo - Channel Configuration Mutation via Write-Scoped API Keys](https://agentprime.io/advisories/CVE-2026-56335.md)
  `CVE-2026-56335` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 10 Jul 2026 · Tags: Broken access control
- [Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding](https://agentprime.io/advisories/CVE-2026-56329.md)
  `CVE-2026-56329` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-436
- [Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint](https://agentprime.io/advisories/CVE-2026-56312.md)
  `CVE-2026-56312` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Authentication bypass
- [Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint](https://agentprime.io/advisories/CVE-2026-56309.md)
  `CVE-2026-56309` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service
- [Capgo - Authentication Bypass in Password Change via Missing Current Password Validation](https://agentprime.io/advisories/CVE-2026-56305.md)
  `CVE-2026-56305` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-620
- [Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint](https://agentprime.io/advisories/CVE-2026-56279.md)
  `CVE-2026-56279` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 10 Jul 2026 · Tags: Broken access control
- [Capgo - EXIF Metadata Exposure in App Information Image Upload](https://agentprime.io/advisories/CVE-2026-56298.md)
  `CVE-2026-56298` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Information disclosure
- [Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()](https://agentprime.io/advisories/CVE-2026-56293.md)
  `CVE-2026-56293` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control
- [Capgo - HTML Injection Leading to Open Redirection in Organization Settings](https://agentprime.io/advisories/CVE-2026-56283.md)
  `CVE-2026-56283` · CVE record: Capgo Capgo · CVSS 4.8 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions](https://agentprime.io/advisories/CVE-2026-56250.md)
  `CVE-2026-56250` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control
- [Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance](https://agentprime.io/advisories/CVE-2026-56246.md)
  `CVE-2026-56246` · CVE record: Capgo Capgo · CVSS 7.2 High · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control
- [Capgo - Unauthorized Manifest Insertion via Read-Only Org Member](https://agentprime.io/advisories/CVE-2026-56220.md)
  `CVE-2026-56220` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control
- [Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update](https://agentprime.io/advisories/CVE-2026-56217.md)
  `CVE-2026-56217` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control
- [Capgo - Missing UPDATE RLS Policy for Build Status Persistence](https://agentprime.io/advisories/CVE-2026-56334.md)
  `CVE-2026-56334` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates](https://agentprime.io/advisories/CVE-2026-56333.md)
  `CVE-2026-56333` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-20
- [Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String](https://agentprime.io/advisories/CVE-2026-56331.md)
  `CVE-2026-56331` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Information disclosure
- [Capgo - Integrity Issue in Release Routing via Multiple Public Channels](https://agentprime.io/advisories/CVE-2026-56328.md)
  `CVE-2026-56328` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-670
- [Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC](https://agentprime.io/advisories/CVE-2026-56327.md)
  `CVE-2026-56327` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Information disclosure
- [Capgo - Org/App Scope Mismatch in Device Creation Endpoint](https://agentprime.io/advisories/CVE-2026-56320.md)
  `CVE-2026-56320` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Capgo - Information Disclosure via /private/validate_password_compliance Endpoint](https://agentprime.io/advisories/CVE-2026-56318.md)
  `CVE-2026-56318` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Information disclosure
- [Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions](https://agentprime.io/advisories/CVE-2026-56300.md)
  `CVE-2026-56300` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 30 Jun 2026 · Tags: Information disclosure
- [Capgo - Account Deletion Without Password Confirmation](https://agentprime.io/advisories/CVE-2026-56286.md)
  `CVE-2026-56286` · CVE record: Capgo Capgo · CVSS 7.0 High · Not analysed yet · Published 30 Jun 2026 · Tags: Authentication bypass
- [Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision](https://agentprime.io/advisories/CVE-2026-56249.md)
  `CVE-2026-56249` · CVE record: Capgo Capgo · CVSS 7.2 High · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment](https://agentprime.io/advisories/CVE-2026-56247.md)
  `CVE-2026-56247` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 30 Jun 2026 · Tags: Privilege escalation
- [Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy](https://agentprime.io/advisories/CVE-2026-56233.md)
  `CVE-2026-56233` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 30 Jun 2026 · Tags: Path traversal
- [Capgo - Broken Object Level Authorization via x-limited-key-id Header](https://agentprime.io/advisories/CVE-2026-56230.md)
  `CVE-2026-56230` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Capgo - Login CSRF and Session Fixation via URL Query Parameters](https://agentprime.io/advisories/CVE-2026-56224.md)
  `CVE-2026-56224` · CVE record: Capgo Capgo · CVSS 5.1 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Authentication bypass
- [Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass](https://agentprime.io/advisories/CVE-2026-56219.md)
  `CVE-2026-56219` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 30 Jun 2026 · Tags: Authentication bypass
- [Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint](https://agentprime.io/advisories/CVE-2026-56338.md)
  `CVE-2026-56338` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-703
- [Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2](https://agentprime.io/advisories/CVE-2026-56337.md)
  `CVE-2026-56337` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Information disclosure
- [Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security](https://agentprime.io/advisories/CVE-2026-56302.md)
  `CVE-2026-56302` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update](https://agentprime.io/advisories/CVE-2026-56257.md)
  `CVE-2026-56257` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [Capgo - Two-Factor Authentication Bypass via Organization Management API](https://agentprime.io/advisories/CVE-2026-56256.md)
  `CVE-2026-56256` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-602
- [Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key](https://agentprime.io/advisories/CVE-2026-56244.md)
  `CVE-2026-56244` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 24 Jun 2026 · Tags: Information disclosure
- [Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation](https://agentprime.io/advisories/CVE-2026-56237.md)
  `CVE-2026-56237` · CVE record: Capgo Capgo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Authentication bypass
- [Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header](https://agentprime.io/advisories/CVE-2026-56232.md)
  `CVE-2026-56232` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter](https://agentprime.io/advisories/CVE-2026-56231.md)
  `CVE-2026-56231` · CVE record: Capgo Capgo · CVSS 7.2 High · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user](https://agentprime.io/advisories/CVE-2026-56223.md)
  `CVE-2026-56223` · CVE record: Capgo Capgo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Authentication bypass
- [Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter](https://agentprime.io/advisories/CVE-2026-56322.md)
  `CVE-2026-56322` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 23 Jun 2026 · Tags: Information disclosure
- [Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane](https://agentprime.io/advisories/CVE-2026-56243.md)
  `CVE-2026-56243` · CVE record: Capgo Capgo · CVSS 8.6 High · Not analysed yet · Published 23 Jun 2026 · Tags: Authentication bypass
- [Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint](https://agentprime.io/advisories/CVE-2026-56234.md)
  `CVE-2026-56234` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Authentication bypass
- [Capgo - Authorization Bypass in API Key Management via App-Limited Keys](https://agentprime.io/advisories/CVE-2026-56225.md)
  `CVE-2026-56225` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 23 Jun 2026 · Tags: Privilege escalation
- [Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings](https://agentprime.io/advisories/CVE-2026-56222.md)
  `CVE-2026-56222` · CVE record: Capgo Capgo · CVSS 8.6 High · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control
- [Capgo - Rate Limit Bypass via User-Controlled device_id Parameter](https://agentprime.io/advisories/CVE-2026-56324.md)
  `CVE-2026-56324` · CVE record: Capgo Capgo · CVSS 8.8 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service
- [Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self](https://agentprime.io/advisories/CVE-2026-56323.md)
  `CVE-2026-56323` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 22 Jun 2026 · Tags: Information disclosure
- [Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint](https://agentprime.io/advisories/CVE-2026-56321.md)
  `CVE-2026-56321` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Authentication bypass
- [Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint](https://agentprime.io/advisories/CVE-2026-56314.md)
  `CVE-2026-56314` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-672
- [Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC](https://agentprime.io/advisories/CVE-2026-56311.md)
  `CVE-2026-56311` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Broken access control
- [Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing](https://agentprime.io/advisories/CVE-2026-56306.md)
  `CVE-2026-56306` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-20
- [Capgo - Denial of Service via Unlimited Demo App Creation](https://agentprime.io/advisories/CVE-2026-56255.md)
  `CVE-2026-56255` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service
- [Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint](https://agentprime.io/advisories/CVE-2026-56299.md)
  `CVE-2026-56299` · CVE record: Capgo Capgo · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Authentication bypass

Older: <https://agentprime.io/advisories/technology/capgo.md?cursor=WyIyMDI2LTA2LTIxVDEzOjI2OjU1LjUxOTAwMFoiLCJDVkUtMjAyNi01NjI5OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=capgo>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/capgo/>. Everything for agents: <https://agentprime.io/llms.txt>.