Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.
CVE-2026-56299 is an authentication bypass vulnerability in Capgo versions before 12.128.2 affecting the /build/upload/:jobId/* endpoint. It allows unauthenticated attackers to send OPTIONS requests that bypass authentication middleware and trigger consistent 500 errors. This enables attackers to flood requests and cause denial of service. The vulnerability is fixed in version 12.128.2.
Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.
Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to super_admin. Attackers can exploit the insufficient RLS enforcement to gain unauthorized super_admin access and compromise system security.
Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs like get_orgs_v6 to retrieve organization membership and management email PII.
Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks (no validation of auth.uid(), org membership, or check_min_rights). Because the function runs with the owner's privileges, it bypasses Row Level Security. If EXECUTE permission is available to the authenticated or anon roles (explicitly or via default privileges), an authenticated user could invoke it via Supabase RPC to manipulate billing data for arbitrary organizations, including unauthorized credit depletion and fraudulent overage event insertion.
Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.
Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched app_id and job_id combination. Limited API keys restricted to a single app can retrieve build status and logs from other apps by providing an authorized app_id while using a job_id from an unauthorized app, exposing sensitive build information including logs, metadata, and potentially credentials.
CVE-2026-56332 is an open redirect vulnerability in Capgo versions before 12.128.2. The flaw exists in the confirm-signup endpoint where the confirmation_url parameter is not validated, allowing attackers to redirect users to arbitrary external websites. This can be exploited to craft malicious links for phishing and credential harvesting attacks. The vulnerability has a medium severity with a CVSS score of 5.1. A fix is available in Capgo version 12.128.2.
CVE-2026-56330 is an open redirect vulnerability in Capgo versions before 12.128.2. It affects the stripe_portal and stripe_checkout endpoints, which accept unvalidated URL parameters (callbackUrl, successUrl, cancelUrl). Authenticated attackers can exploit this flaw to redirect users to malicious domains, potentially facilitating phishing and credential theft.
CVE-2026-56319 is an information disclosure vulnerability in Capgo versions before 12.128.2. It affects the GET /statistics/app/:app_id endpoint, allowing attackers with app-limited API keys to distinguish existing sibling app IDs by observing different error responses. This enables enumeration of real app IDs outside their authorized scope, breaking tenant isolation.
Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can exploit non-advancing cursor filters to trigger infinite pagination loops, prevent dataset traversal, and cause repeated processing in device-management workflows.
CVE-2026-56295 is an authorization bypass vulnerability in Capgo versions before 12.128.2. It affects webhook management endpoints by allowing legacy non-expiring API keys to bypass an organizational policy that requires API key expiration. This occurs because the function responsible for checking webhook permissions does not properly enforce the expiration policy, enabling unauthorized listing, creation, and deletion of webhooks.
CVE-2026-56282 is an information disclosure vulnerability in Capgo versions before 12.128.2. It affects the unauthenticated /replication endpoint, which exposes internal PostgreSQL replication telemetry data such as slot names and WAL LSN positions. This allows unauthorized actors to gather sensitive infrastructure details useful for reconnaissance.
Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) that are granted to the anon role without enforcing org membership or permission checks. An unauthenticated attacker using only the public Supabase API key (sb_publishable_*) can query arbitrary org_id values to disclose cross-tenant usage telemetry (MAU, bandwidth, installs, gets), enumerate app IDs for a target org, and determine org existence via an oracle (valid org returns metrics, invalid returns []).
Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of characters) as the minimum password length, making compliance impossible for all organization members. Once the policy is enabled, users (including administrators) are unable to change their passwords or access the organization, resulting in an organization-wide account lockout and application-level denial of service.
Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these addresses with error responses disclosed to users.
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical location at capture time.
CVE-2026-56325 is a low-severity vulnerability in Capgo versions before 12.128.2 where improper input validation allows underscore characters in app_id to act as SQL wildcards during app_id lookup. This can cause unintended pattern matches that break preview functionality or cause app-id confusion.
Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted keys by setting empty limits. Attackers with a compromised app-limited key can create an unrestricted key with org-wide access to resources like app listings and other protected endpoints.