CVE-2026-100617

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

CVE-2026-100617

The Cap-go capgo.app application contains an authorization bypass vulnerability due to a failure to validate that principals in channel_permission_overrides belong to the organization. Authenticated users with app or organization admin privileges can exploit this by inserting override rows with a...

CVE-2026-100617 Cap-go capgo.app Authorization Bypass via channel_permission_overrides

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

CVE-2026-100617 Cap-go capgo.app Authorization Bypass via channel_permission_overrides

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

EUVD-2026-87712

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

EUVD-2026-87710

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

CVE-2026-100615

Versions of Cap-go capgo.app prior to 12.267.1 are vulnerable to a privilege escalation flaw because the system fails to validate target API key privileges during the rotation process. An attacker with the apikey_manager role can enumerate API keys owned by the same entity and use the PUT endpoin...

CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

Astra Linux – Vulnerability in docker.io-app

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not limit filesystem operations to the destination directory. The extractor determines the location of each archive entry using lexical string checks, and then performs the...

CLEANSTART-2026-DU50032 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-NH53620 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the loki package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2026-ZA34964 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-WV65132 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the loki package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...

CLEANSTART-2026-WS35873 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

Security vulnerability affects the loki package. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp"...

CLEANSTART-2026-QP25328 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the loki package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

CLEANSTART-2026-YE69466 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-VW95960 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...