7 matches found
CVE-2026-100629
Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...
CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...
CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...
EUVD-2026-87723
Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...
CVE-2026-100629
The Capgo (capgo.app backend) before version 12.127.5 is vulnerable to an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The application correctly verifies that the new role's rank does not exceed the caller's rank but fails to check the rank of the role currently bo...
CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...
CVE-2026-100629: Incorrect Authorization
Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...