CVE-2026-56239

Capgo CVE-2026-56239 affects Capgo before 12.128.2. The vulnerability lies in the public.apply_usage_overage SECURITY DEFINER function, which performs billing operations without validating authorization (no auth.uid(), org membership, or check_min_rights). Because the function runs with the owner...

Shopify: IDOR on GraphQL queries BillingDocumentDownload and BillDetails

A vulnerability allowed unauthorized access to billing invoice information for other merchants...