# Capgo vulnerabilities Source: https://junglewise.ai/threats/vendors/capgo Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/capgo.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 98 vulnerabilities in Capgo: 0 in the last 7 days and 9 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100629, was published on 26 September 2026. Nothing in the last four weeks, down from 7 vulnerabilities in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 9 - All time: 98 (2 critical, 0 exploited in the wild) ## About Capgo A provider of cloud-based update and deployment services for Capacitor and Ionic applications. ## Latest Capgo vulnerabilities - [CVE-2026-100629: Capgo backend authorization flaw in role bindings PATCH endpoint](https://junglewise.ai/threats/cve-2026-100629-capgo-capgo-app-backend-before-12-127-5-contains-an) (medium, CVSS 5.5, published 26 Sep 2026) - [CVE-2026-100625: Capgo build upload proxy authorization bypass via TUS resource](https://junglewise.ai/threats/cve-2026-100625-capgo-capgo-app-exposes-a-native-build-tus-upload-proxy-supabase) (high, CVSS 7.1, published 26 Sep 2026) - [CVE-2026-100624: Capgo.app build upload proxy session expiry bypass](https://junglewise.ai/threats/cve-2026-100624-capgo-app-before-12-264-5-does-not-enforce-upload-expiry-or) (medium, CVSS 5.4, published 26 Sep 2026) - [CVE-2026-100619: Capgo manifest poisoning via app_versions bypass](https://junglewise.ai/threats/cve-2026-100619-capgo-capgo-app-blocks-direct-user-inserts-into-the-public) (high, CVSS 8.8, published 26 Sep 2026) - [CVE-2026-100618: Capgo app icon update authorization bypass in worker](https://junglewise.ai/threats/cve-2026-100618-capgo-capgo-app-is-affected-by-an-authorization-flaw-in-the-app) (high, CVSS 8.5, published 26 Sep 2026) - [CVE-2026-100612: Capgo access control bypass in SSO provider configuration](https://junglewise.ai/threats/cve-2026-100612-capgo-capgo-app-through-version-12-261-0-contains-an-incomplete) (high, CVSS 7.2, published 26 Sep 2026) - [CVE-2026-100611: Capgo apikey_manager role privilege escalation via incomplete role deny-list](https://junglewise.ai/threats/cve-2026-100611-capgo-capgo-app-backend-versions-12-261-0-improperly-restricts) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-88864: Capgo authentication bypass via PostgREST direct write to SSO providers](https://junglewise.ai/threats/cve-2026-88864-capgo-authentication-bypass-via-postgrest-direct-write-to-sso) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-88860: Capgo authorization bypass via stale channel permission overrides](https://junglewise.ai/threats/cve-2026-88860-capgo-authorization-bypass-via-stale-channel-permission-overrides) (medium, CVSS 6.3, published 10 Sep 2026) - [CVE-2026-56336: Capgo information disclosure in SSO check-domain endpoint](https://junglewise.ai/threats/cve-2026-56336-capgo-information-disclosure-in-sso-check-domain-endpoint) (medium, CVSS 5.3, published 12 Jul 2026) - [CVE-2026-56313: Capgo improper authorization in SSO prelink endpoint](https://junglewise.ai/threats/cve-2026-56313-capgo-improper-authorization-in-sso-prelink-endpoint) (high, CVSS 8.1, published 12 Jul 2026) - [CVE-2026-56308: Capgo insufficient authentication in email change endpoint](https://junglewise.ai/threats/cve-2026-56308-capgo-insufficient-authentication-in-email-change-endpoint) (high, CVSS 7.3, published 12 Jul 2026) - [CVE-2026-56281: Capgo SQL injection in admin_stats endpoint](https://junglewise.ai/threats/cve-2026-56281-capgo-sql-injection-in-admin-stats-endpoint) (low, CVSS 3.8, published 12 Jul 2026) - [CVE-2026-56252: Capgo incorrect authorization in webhook test endpoint](https://junglewise.ai/threats/cve-2026-56252-capgo-incorrect-authorization-in-webhook-test-endpoint) (medium, CVSS 5.4, published 12 Jul 2026) - [CVE-2026-56241: Capgo privilege escalation via stale RBAC demotion records](https://junglewise.ai/threats/cve-2026-56241-capgo-privilege-escalation-via-stale-rbac-demotion-records) (high, CVSS 8.3, published 12 Jul 2026) - [CVE-2026-56238: Capgo information disclosure in Supabase PostgREST global_stats endpoint](https://junglewise.ai/threats/cve-2026-56238-capgo-information-disclosure-in-supabase-postgrest-global-stats) (high, CVSS 7.5, published 12 Jul 2026) - [CVE-2026-56303: Capgo information disclosure in find_apikey_by_value RPC function](https://junglewise.ai/threats/cve-2026-56303-capgo-information-disclosure-in-find-apikey-by-value-rpc-function) (high, CVSS 7.5, published 11 Jul 2026) - [CVE-2026-56240: Capgo billing authorization bypass in plan_valid calculation](https://junglewise.ai/threats/cve-2026-56240-capgo-billing-authorization-bypass-in-plan-valid-calculation) (medium, CVSS 4.3, published 11 Jul 2026) - [CVE-2026-56335: Capgo authorization bypass in channel configuration via PostgREST](https://junglewise.ai/threats/cve-2026-56335-capgo-authorization-bypass-in-channel-configuration-via-postgrest) (medium, CVSS 6.5, published 10 Jul 2026) - [CVE-2026-56329: Capgo cross-tenant preview namespace collision in hostname parsing](https://junglewise.ai/threats/cve-2026-56329-capgo-cross-tenant-preview-namespace-collision-in-hostname) (medium, CVSS 6.4, published 10 Jul 2026) - [CVE-2026-56312: Capgo improper authentication in accept_invitation endpoint](https://junglewise.ai/threats/cve-2026-56312-capgo-improper-authentication-in-accept-invitation-endpoint) (medium, CVSS 6.5, published 10 Jul 2026) - [CVE-2026-56309: Capgo plan bypass via unrestricted attachment upload endpoint](https://junglewise.ai/threats/cve-2026-56309-capgo-plan-bypass-via-unrestricted-attachment-upload-endpoint) (medium, CVSS 5.4, published 10 Jul 2026) - [CVE-2026-56305: Capgo authentication bypass in password change endpoint](https://junglewise.ai/threats/cve-2026-56305-capgo-authentication-bypass-in-password-change-endpoint) (high, CVSS 8.3, published 10 Jul 2026) - [CVE-2026-56279: Capgo information disclosure in get_orgs_v7 RPC function](https://junglewise.ai/threats/cve-2026-56279-capgo-information-disclosure-in-get-orgs-v7-rpc-function) (high, CVSS 7.5, published 10 Jul 2026) - [CVE-2026-56254: Cap-go capacitor-updater encryption bypass via private key distribution](https://junglewise.ai/threats/cve-2026-56254-cap-go-capacitor-updater-encryption-bypass-via-private-key) (high, CVSS 7, published 10 Jul 2026) ## Most severe Capgo vulnerabilities - [CVE-2026-88864: Capgo authentication bypass via PostgREST direct write to SSO providers](https://junglewise.ai/threats/cve-2026-88864-capgo-authentication-bypass-via-postgrest-direct-write-to-sso) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-56237: Capgo broken authentication in API key generation](https://junglewise.ai/threats/cve-2026-56237-capgo-broken-authentication-in-api-key-generation) (critical, CVSS 9.1, published 24 Jun 2026) - [CVE-2026-100619: Capgo manifest poisoning via app_versions bypass](https://junglewise.ai/threats/cve-2026-100619-capgo-capgo-app-blocks-direct-user-inserts-into-the-public) (high, CVSS 8.8, published 26 Sep 2026) - [CVE-2026-56247: Capgo privilege escalation via cross-scope RBAC role assignment](https://junglewise.ai/threats/cve-2026-56247-capgo-privilege-escalation-via-cross-scope-rbac-role-assignment) (high, CVSS 8.8, published 30 Jun 2026) - [CVE-2026-56230: Capgo BOLA in middlewareKey via x-limited-key-id header](https://junglewise.ai/threats/cve-2026-56230-capgo-bola-in-middlewarekey-via-x-limited-key-id-header) (high, CVSS 8.8, published 30 Jun 2026) - [CVE-2026-56232: Capgo authorization bypass in middlewareKey subkey enforcement](https://junglewise.ai/threats/cve-2026-56232-capgo-authorization-bypass-in-middlewarekey-subkey-enforcement) (high, CVSS 8.8, published 24 Jun 2026) - [CVE-2026-56216: Capgo scope escalation via API key creation in functions endpoint](https://junglewise.ai/threats/cve-2026-56216-capgo-scope-escalation-via-api-key-creation-in-functions-endpoint) (high, CVSS 8.8, published 20 Jun 2026) - [CVE-2026-56223: Capgo account takeover via cross-domain SSO identity merge](https://junglewise.ai/threats/cve-2026-56223-capgo-account-takeover-via-cross-domain-sso-identity-merge) (high, CVSS 8.7, published 24 Jun 2026) - [CVE-2026-100618: Capgo app icon update authorization bypass in worker](https://junglewise.ai/threats/cve-2026-100618-capgo-capgo-app-is-affected-by-an-authorization-flaw-in-the-app) (high, CVSS 8.5, published 26 Sep 2026) - [CVE-2026-56241: Capgo privilege escalation via stale RBAC demotion records](https://junglewise.ai/threats/cve-2026-56241-capgo-privilege-escalation-via-stale-rbac-demotion-records) (high, CVSS 8.3, published 12 Jul 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 7 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 2 | 1 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 7 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Capgo technologies - [Capgo](https://junglewise.ai/threats/technologies/capgo): 84 vulnerabilities - [Capgo.app](https://junglewise.ai/threats/technologies/capgo-app): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Capgo vulnerabilities", https://junglewise.ai/threats/vendors/capgo, 9 November 2026.