EUVD-2026-87770

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626

Versions of capgo through 12.128.2 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the PUT /app/:appId endpoint. The root cause is that the endpoint accepts attacker-controlled icon storage paths . This allows authenticated users to provide arbitrary paths in the pri...

PT-2026-99297

Name of the Vulnerable Software and Affected Versions capgo versions prior to 12.128.3 Description An insecure direct object reference occurs in the 'PUT /app/:appId' endpoint, which accepts attacker-controlled icon storage paths. Authenticated users can provide arbitrary paths within the private...