# Cap-go vulnerabilities Source: https://junglewise.ai/threats/technologies/cap-go Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cap-go.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in Cap-go: 0 in the last 7 days and 7 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100628, was published on 26 September 2026. Nothing in the last four weeks, down from 5 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 7 - All time: 18 (2 critical, 0 exploited in the wild) ## About Cap-go A library for managing live updates in Capacitor applications. ## Latest Cap-go vulnerabilities - [CVE-2026-100628: Capgo app-scoped API key creation bypasses organization expiration policy](https://junglewise.ai/threats/cve-2026-100628-capgo-app-before-12-128-12-fails-to-enforce-an-organization-s) (medium, CVSS 4.3, published 26 Sep 2026) - [CVE-2026-100626: capgo insecure direct object reference in PUT /app icon endpoint](https://junglewise.ai/threats/cve-2026-100626-capgo-through-12-128-2-contains-an-insecure-direct-object) (medium, CVSS 4.3, published 26 Sep 2026) - [CVE-2026-100621: Capgo content-lock bypass via r2-direct bundle mutation](https://junglewise.ai/threats/cve-2026-100621-capgo-capgo-app-contains-an-incomplete-access-control-content) (medium, CVSS 4.3, published 26 Sep 2026) - [CVE-2026-100614: Capgo metadata-cleaning worker cross-tenant image overwrite](https://junglewise.ai/threats/cve-2026-100614-capgo-before-12-244-1-contains-a-cross-tenant-integrity) (high, CVSS 8.8, published 26 Sep 2026) - [CVE-2026-100613: capgo App Transfer Authorization Bypass via Stale Channel Overrides](https://junglewise.ai/threats/cve-2026-100613-capgo-app-is-an-over-the-air-ota-update-platform-for-capacitor) (medium, CVSS 5.3, published 26 Sep 2026) - [CVE-2026-88863: capgo Privilege escalation in invite_new_user_to_org](https://junglewise.ai/threats/cve-2026-88863-capgo-privilege-escalation-in-invite-new-user-to-org) (high, CVSS 8.1, published 10 Sep 2026) - [CVE-2026-88861: Capgo authentication bypass in Edge authorization via AAL1 session](https://junglewise.ai/threats/cve-2026-88861-capgo-authentication-bypass-in-edge-authorization-via-aal1) (high, CVSS 8.3, published 10 Sep 2026) - [CVE-2026-56339: Capgo information disclosure via organization enumeration in rescind_invitation RPC](https://junglewise.ai/threats/cve-2026-56339-capgo-information-disclosure-via-organization-enumeration-in) (high, CVSS 7.5, published 15 Jul 2026) - [CVE-2026-56296: Cap-go information disclosure in transfer_app RPC function](https://junglewise.ai/threats/cve-2026-56296-cap-go-information-disclosure-in-transfer-app-rpc-function) (medium, CVSS 5.3, published 11 Jul 2026) - [CVE-2026-56310: Cap-go authorization bypass in organization members endpoint](https://junglewise.ai/threats/cve-2026-56310-cap-go-authorization-bypass-in-organization-members-endpoint) (medium, CVSS 4.3, published 24 Jun 2026) - [CVE-2026-56280: Cap-go privilege inversion in build log stream via SSE disconnect](https://junglewise.ai/threats/cve-2026-56280-cap-go-privilege-inversion-in-build-log-stream-via-sse-disconnect) (high, CVSS 7.1, published 22 Jun 2026) - [CVE-2026-56221: Cap-go SQL injection in cloudflare.ts analytics queries](https://junglewise.ai/threats/cve-2026-56221-cap-go-sql-injection-in-cloudflare-ts-analytics-queries) (medium, CVSS 6.5, published 22 Jun 2026) - [CVE-2026-56307: Cap-go broken cursor pagination in /private/devices endpoint](https://junglewise.ai/threats/cve-2026-56307-cap-go-broken-cursor-pagination-in-private-devices-endpoint) (medium, CVSS 4.3, published 20 Jun 2026) - [CVE-2026-56235: Cap-go capgo authorization bypass in Supabase RPC functions](https://junglewise.ai/threats/cve-2026-56235-cap-go-capgo-authorization-bypass-in-supabase-rpc-functions) (medium, CVSS 5.3, published 20 Jun 2026) - [CVE-2026-56081: Cap-go authentication bypass and account lockout via 2FA misconfiguration](https://junglewise.ai/threats/cve-2026-56081-cap-go-authentication-bypass-and-account-lockout-via-2fa) (critical, CVSS 9.1, published 19 Jun 2026) - [CVE-2026-56080: Cap-go capgo denial of service via password policy lockout](https://junglewise.ai/threats/cve-2026-56080-cap-go-capgo-denial-of-service-via-password-policy-lockout) (medium, CVSS 4.9, published 19 Jun 2026) - [CVE-2026-56073: Cap-go authentication bypass in OTP verification](https://junglewise.ai/threats/cve-2026-56073-cap-go-authentication-bypass-in-otp-verification) (critical, CVSS 9.4, published 19 Jun 2026) - [CVE-2026-53981: Cap-go account takeover via insecure email change mechanism](https://junglewise.ai/threats/cve-2026-53981-cap-go-account-takeover-via-insecure-email-change-mechanism) (high, CVSS 7.6, published 12 Jun 2026) ## Most severe Cap-go vulnerabilities - [CVE-2026-56073: Cap-go authentication bypass in OTP verification](https://junglewise.ai/threats/cve-2026-56073-cap-go-authentication-bypass-in-otp-verification) (critical, CVSS 9.4, published 19 Jun 2026) - [CVE-2026-56081: Cap-go authentication bypass and account lockout via 2FA misconfiguration](https://junglewise.ai/threats/cve-2026-56081-cap-go-authentication-bypass-and-account-lockout-via-2fa) (critical, CVSS 9.1, published 19 Jun 2026) - [CVE-2026-100614: Capgo metadata-cleaning worker cross-tenant image overwrite](https://junglewise.ai/threats/cve-2026-100614-capgo-before-12-244-1-contains-a-cross-tenant-integrity) (high, CVSS 8.8, published 26 Sep 2026) - [CVE-2026-88861: Capgo authentication bypass in Edge authorization via AAL1 session](https://junglewise.ai/threats/cve-2026-88861-capgo-authentication-bypass-in-edge-authorization-via-aal1) (high, CVSS 8.3, published 10 Sep 2026) - [CVE-2026-88863: capgo Privilege escalation in invite_new_user_to_org](https://junglewise.ai/threats/cve-2026-88863-capgo-privilege-escalation-in-invite-new-user-to-org) (high, CVSS 8.1, published 10 Sep 2026) - [CVE-2026-53981: Cap-go account takeover via insecure email change mechanism](https://junglewise.ai/threats/cve-2026-53981-cap-go-account-takeover-via-insecure-email-change-mechanism) (high, CVSS 7.6, published 12 Jun 2026) - [CVE-2026-56339: Capgo information disclosure via organization enumeration in rescind_invitation RPC](https://junglewise.ai/threats/cve-2026-56339-capgo-information-disclosure-via-organization-enumeration-in) (high, CVSS 7.5, published 15 Jul 2026) - [CVE-2026-56280: Cap-go privilege inversion in build log stream via SSE disconnect](https://junglewise.ai/threats/cve-2026-56280-cap-go-privilege-inversion-in-build-log-stream-via-sse-disconnect) (high, CVSS 7.1, published 22 Jun 2026) - [CVE-2026-56221: Cap-go SQL injection in cloudflare.ts analytics queries](https://junglewise.ai/threats/cve-2026-56221-cap-go-sql-injection-in-cloudflare-ts-analytics-queries) (medium, CVSS 6.5, published 22 Jun 2026) - [CVE-2026-100613: capgo App Transfer Authorization Bypass via Stale Channel Overrides](https://junglewise.ai/threats/cve-2026-100613-capgo-app-is-an-over-the-air-ota-update-platform-for-capacitor) (medium, CVSS 5.3, published 26 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 5 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 5 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Cap-go technologies - [Cap-go Capgo](https://junglewise.ai/threats/technologies/cap-go-capgo): 5 vulnerabilities - [Cap-go Capgo.app](https://junglewise.ai/threats/technologies/cap-go-capgo-app): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Cap-go vulnerabilities", https://junglewise.ai/threats/technologies/cap-go, 9 November 2026.