Vulnerabilidades en Capgo
83 resultadosAnálisis Vexday
Capgo apresenta 82 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando exposição recente e significativa. Embora nenhuma esteja sob ataque ativo no momento, apenas 2 são críticas, a fraqueza dominante é exposição de informações (CWE-200), sugerindo vazamento de dados como padrão de risco principal. A concentração de divulgações recentes demanda monitoramento contínuo para detecção precoce de exploração em larga escala.
CVE-2026-56219HIGHCapgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth BypassEPSS 0.4%CVE-2026-56251HIGHCapgo - Privilege Escalation via Broken Row Level Security in org_usersEPSS 0.4%CVE-2026-56216HIGHCapgo - Scope Escalation via API Key Creation in /functions/v1/apikeyEPSS 0.4%CVE-2026-56247HIGHCapgo - Privilege Escalation via Cross-Scope RBAC Role AssignmentEPSS 0.4%CVE-2026-56242HIGHCapgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPCEPSS 0.4%CVE-2026-56337MEDIUMCapgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2EPSS 0.4%CVE-2026-56308HIGHCapgo - Insufficient Authentication in Email Change EndpointEPSS 0.4%CVE-2026-56279HIGHCapgo - Information Disclosure via get_orgs_v7 RPC EndpointEPSS 0.4%CVE-2026-56335HIGHCapgo - Channel Configuration Mutation via Write-Scoped API KeysEPSS 0.4%CVE-2026-56314HIGHCapgo - Deleted Bundle Selection via Missing Deletion Filter in /updates EndpointEPSS 0.4%CVE-2026-56253HIGHCapgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPCEPSS 0.4%CVE-2026-56256HIGHCapgo - Two-Factor Authentication Bypass via Organization Management APIEPSS 0.4%CVE-2026-56225HIGHCapgo - Authorization Bypass in API Key Management via App-Limited KeysEPSS 0.4%CVE-2026-56079HIGHCapgo - Cross-Tenant Authorization Bypass via PostgREST Webhook AccessEPSS 0.4%CVE-2026-56246HIGHCapgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege InheritanceEPSS 0.4%CVE-2026-56234MEDIUMCapgo - Password Spraying via Public-Key Accessible Credential Validation EndpointEPSS 0.4%CVE-2026-56282MEDIUMCapgo - Information Disclosure via Unauthenticated /replication EndpointEPSS 0.4%CVE-2026-56215HIGHCapgo - Account Merge via Poisoned public.users.email in SSO ProvisioningEPSS 0.4%CVE-2026-56243HIGHCapgo - Hashed API Key Enforcement Bypass via PostgREST/RLS PlaneEPSS 0.4%CVE-2026-56312MEDIUMCapgo - Account Creation Before CAPTCHA Validation in accept_invitation EndpointEPSS 0.4%