CVE-2026-100612 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

CVE-2026-100612 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

CVE-2026-100612 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

EUVD-2026-87707

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

CVE-2026-100612

Capgo (capgo.app) versions through 12.261.0 are vulnerable to a vertical privilege escalation and account takeover due to an incomplete access-control fix in the public.sso_providers table. The migration 20260826100000_sso_providers_block_direct_active_insert.sql fails to freeze the provider_id c...

CVE-2026-100623: Incorrect Authorization

Capgo capgo.app exposes the legacy membership table public.orgusers directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization...

CVE-2026-100616: Incorrect Authorization

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin a user holding org.updatesettings to update the entire row, including the internal billing pointer column...

CVE-2026-100612: Authorization Bypass Through User-Controlled Key

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

PT-2026-99284

Name of the Vulnerable Software and Affected Versions capgo.app affected versions not specified Description The transfer app database function fails to delete or revalidate existing rows in channel permission overrides when transferring an app, its channels, versions, and related records to a...

CVE-2026-100613: Incorrect Authorization

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

PT-2026-99283

Name of the Vulnerable Software and Affected Versions Capgo capgo.app versions prior to 12.261.0 Description An incomplete access-control fix in the public.sso providers table allows a user with org admin permissions and the org.update settings permission to perform vertical privilege escalation...

PT-2026-99294

🚨 CVE-2026-100623 Capgo capgo.app exposes the legacy membership table public.org users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization...

PT-2026-99292

Name of the Vulnerable Software and Affected Versions Capgo capgo.app affected versions not specified Description An incomplete access-control and content-lock enforcement issue exists where the enforce encrypted bundle trigger and check encrypted bundle on insert locks exempt rows in app version...

CVE-2026-100621: Improper Access Control

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-88864

Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...

CVE-2026-88864 Capgo SSO Provider Authentication Bypass via PostgREST Direct Write

Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...

CVE-2026-88864 Capgo SSO Provider Authentication Bypass via PostgREST Direct Write

Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...

EUVD-2026-75414

Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...

CVE-2026-88864

Capgo (capgo.app) contains an authentication bypass vulnerability in its SSO provider management. The public.sso_providers table is exposed through Supabase PostgREST without restricting direct write access. A holder of an ordinary full API key can insert a forged row with status='active' and enf...

PT-2026-89375

Capgo capgo.app fails to restrict direct write access to the public.sso providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce sso=true, bypassing the intended backend SSO provisioning route...