Latest high and critical flaws
- CVE-2026-100629 Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint.High 7 · Sep 26, 2026
- CVE-2026-100628 capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys.High 8.7 · Sep 26, 2026
- CVE-2026-100627 Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path.High 7.2 · Sep 26, 2026
- CVE-2026-100625 Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build jHigh 8.7 · Sep 26, 2026
- CVE-2026-100623 Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST.High 8.7 · Sep 26, 2026
- CVE-2026-100622 capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint.High 8.7 · Sep 26, 2026
- CVE-2026-100619 Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed iHigh 8.7 · Sep 26, 2026
- CVE-2026-100618 Capgo (capgo.app) is affected by an authorization flaw in the app icon update path.High 8.7 · Sep 26, 2026
- CVE-2026-100617 Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant chHigh 8.7 · Sep 26, 2026
- CVE-2026-100616 capgo.app is an over-the-air update platform for Capacitor apps.High 7 · Sep 26, 2026
- CVE-2026-100615 Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_High 8.7 · Sep 26, 2026
- CVE-2026-100614 Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows wHigh 8.7 · Sep 26, 2026
- CVE-2026-100612 Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table.High 8.6 · Sep 26, 2026
- CVE-2026-100611 Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys.High 7.1 · Sep 26, 2026
- CVE-2026-88864 Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST.Critical 9.3 · Sep 10, 2026
- CVE-2026-88863 capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of High 8.6 · Sep 10, 2026
- CVE-2026-88862 Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header.High 8.7 · Sep 10, 2026
- CVE-2026-88861 Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication).High 8.7 · Sep 10, 2026
- CVE-2026-88860 Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active.Critical 9.3 · Sep 10, 2026
- CVE-2026-56339 Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invHigh 8.7 · Jul 15, 2026
- CVE-2026-56226 Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the aHigh 8.7 · Jul 8, 2026
- CVE-2026-56245 Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticatedHigh 8.8 · Jun 24, 2026
- CVE-2026-56248 Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level SecurityHigh 8.7 · Jun 23, 2026
- CVE-2026-56280 Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native buiHigh 7.1 · Jun 22, 2026
- CVE-2026-56221 Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated diHigh 7.1 · Jun 22, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.