Threats tagged 'ghsa-g675-f5v2-69hx'

CVE-2026-100626 is an authorization bypass vulnerability in capgo.app versions up to 12.128.2. It affects the PUT /app/:appId endpoint, allowing authenticated users to supply arbitrary icon storage paths in a private images bucket. This enables them to obtain service-role-signed URLs valid for 7 days, which can be used to read cross-tenant objects such as user avatars, organization logos, and app icons without proper authorization.