Cap-go vulnerabilities

Newest CVEs

• CVE-2026-100626

  capgo through 12.128.2 IDOR via PUT /app icon endpoint

  Cap-go · capgo.app

  Medium5.3
• CVE-2026-100629

  Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

  Cap-go · capgo.app

  High7.0
• CVE-2026-100628

  capgo.app before 12.128.12 Authentication Bypass via apikey

  Cap-go · capgo.app

  High8.7
• CVE-2026-100627

  Capgo bundle promotion API channel RBAC deny override bypass

  Cap-go · capgo.app

  High7.2
• CVE-2026-100625

  Capgo Build Upload Proxy Authorization Bypass via TUS Resource

  Cap-go · capgo.app

  High8.7
• CVE-2026-100624

  Capgo.app before 12.264.5 Upload Expiry Bypass via build upload

  Cap-go · capgo.app

  Medium5.3
• CVE-2026-100623

  Capgo Authentication Bypass via Direct PostgREST org_users Table Write

  Cap-go · capgo.app

  High8.7
• CVE-2026-100622

  capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

  Cap-go · capgo.app

  High8.7
• CVE-2026-100621

  capgo.app Content-Lock Bypass via r2-direct Bundle Mutation

  Cap-go · capgo.app

  Medium5.3
• CVE-2026-100620

  Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account

  Cap-go · @capgo/cli

  Medium5.1