Vulnerabilities in capgo

83 results
Vexday analysis

Capgo possui apenas 1 CVE registrado na base, publicado recentemente (últimos 90 dias), relacionado a questões de link/path traversal (CWE-59), sem evidência de exploração ativa no cenário de ameaças. O risco atual é baixo, mas a recência da vulnerabilidade exige validação da aplicabilidade ao seu ambiente.

CVE-2026-56225HIGHCapgo - Authorization Bypass in API Key Management via App-Limited KeysEPSS 0.3%CVE-2026-56338MEDIUMCapgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointEPSS 0.3%CVE-2026-56313HIGHCapgo - Cross-Organization Account Disruption via SSO Prelink EndpointEPSS 0.3%CVE-2026-56312MEDIUMCapgo - Account Creation Before CAPTCHA Validation in accept_invitation EndpointEPSS 0.3%CVE-2026-56243HIGHCapgo - Hashed API Key Enforcement Bypass via PostgREST/RLS PlaneEPSS 0.3%CVE-2026-56232HIGHCapgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id HeaderEPSS 0.3%CVE-2026-56337MEDIUMCapgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2EPSS 0.3%CVE-2026-56318MEDIUMCapgo - Information Disclosure via /private/validate_password_compliance EndpointEPSS 0.3%CVE-2026-56327MEDIUMCapgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCEPSS 0.3%CVE-2026-56227MEDIUMCapgo - Server-Side Request Forgery via Webhook URL ValidationEPSS 0.3%CVE-2026-56309MEDIUMCapgo - Plan Bypass via Unrestricted Attachment Upload EndpointEPSS 0.3%CVE-2026-56250HIGHCapgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versionsEPSS 0.3%CVE-2026-53868HIGHCapgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and DeletionEPSS 0.3%CVE-2026-56249HIGHCapgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name CollisionEPSS 0.3%CVE-2026-56330MEDIUMCapgo - Open Redirect via Unvalidated Stripe Billing URLsEPSS 0.3%CVE-2026-56331MEDIUMCapgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic StringEPSS 0.3%CVE-2026-56328HIGHCapgo - Integrity Issue in Release Routing via Multiple Public ChannelsEPSS 0.2%CVE-2026-56234MEDIUMCapgo - Password Spraying via Public-Key Accessible Credential Validation EndpointEPSS 0.2%CVE-2026-56223CRITICALCapgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-userEPSS 0.2%CVE-2026-56308HIGHCapgo - Insufficient Authentication in Email Change EndpointEPSS 0.2%