Advisories · Technology
Capgo.
Every CVE that names Capgo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC
- Capgo
- Broken access control
- CVSS 7.0 High
Capgo - Privilege Escalation via Broken Row Level Security in org_users
- Capgo
- Privilege escalation
- CVSS 8.7 High
Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC
- Capgo
- Information disclosure
- CVSS 7.2 High
Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage
- Capgo
- Privilege escalation
- CVSS 7.1 High
Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs
- Capgo
- Broken access control
- CVSS 5.1 Medium
Capgo - Open Redirect via confirmation_url Parameter
- Capgo
- Open redirect
- CVSS 4.8 Medium
Capgo - Open Redirect via Unvalidated Stripe Billing URLs
- Capgo
- Open redirect
- CVSS 5.3 Medium
Capgo - App Existence Oracle via GET /statistics/app/:app_id
- Capgo
- Information disclosure
- CVSS 5.3 Medium
Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys
- Capgo
- Broken access control
- CVSS 6.9 Medium
Capgo - Information Disclosure via Unauthenticated /replication Endpoint
- Capgo
- Information disclosure
- CVSS 6.9 Medium
Capgo - Denial of Service via Improper Password Policy Length Validation
- Capgo
- CWE-20
- CVSS 5.3 Medium
Capgo - Server-Side Request Forgery via Webhook URL Validation
- Capgo
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Capgo - EXIF Metadata Exposure via Image Upload
- Capgo
- Information disclosure
- CVSS 2.3 Low
Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup
- Capgo
- CWE-20
- CVSS 8.7 High
Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey
- Capgo
- Privilege escalation
- CVSS 8.7 High
Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning
- Capgo
- Broken access control
- CVSS 8.7 High
Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC
- Capgo
- Information disclosure
- CVSS 6.9 Medium
Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC
- Capgo
- Broken access control
- CVSS 5.1 Medium
Capgo - Improper 2FA Enforcement Logic via Team Security Settings
- Capgo
- Privilege escalation
- CVSS 7.1 High
Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access
- Capgo
- Information disclosure
- CVSS 8.7 High
Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion
- Capgo
- Authentication bypass
- CVSS 5.3 Medium
Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement
- Capgo
- CWE-459