EUVD-2026-87722

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

EUVD-2026-87719

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...

EUVD-2026-87717

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

EUVD-2026-87711

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin a user holding org.updatesettings to update the entire row, including the internal billing pointer column...

EUVD-2026-87708

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...