CVE-2026-100621 capgo.app Content-Lock Bypass via r2-direct Bundle Mutation

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100621

Capgo (capgo.app ) is affected by an incomplete access-control and content-lock enforcement issue across all versions . The enforce_encrypted_bundle_trigger / check_encrypted_bundle_on_insert content lock in supabase/schemas/prod.sql incorrectly exempts app_versions rows where the previous storag...

CVE-2026-100619 Capgo OTA Manifest Poisoning via app_versions.manifest Bypass

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

EUVD-2026-87714

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

CVE-2026-100619

The Capgo (capgo.app) platform is vulnerable to OTA manifest poisoning because row-level security policies on the public.manifest table can be bypassed indirectly. An attacker with an app-scoped upload/write/all API key or write+ rights can update public.app_versions.manifest for versions using t...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100575

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies...

EUVD-2026-87476

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies...

CVE-2026-100575

OpenClaw Slack versions before 2026.8.1 contain a vulnerability where multi-person direct messages fail to properly enforce sender allowlists . This flaw allows disallowed participants to bypass configured sender policies, enabling them to trigger Slack agents and gain unauthorized access to the ...

CVE-2026-100575: Missing Authorization

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies...

CVE-2026-100619: Incorrect Privilege Assignment

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

CVE-2026-100621: Improper Access Control

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

PT-2026-99292

Name of the Vulnerable Software and Affected Versions Capgo capgo.app affected versions not specified Description An incomplete access-control and content-lock enforcement issue exists where the enforce encrypted bundle trigger and check encrypted bundle on insert locks exempt rows in app version...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-93399

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

CVE-2026-93399

The Bookly plugin for WordPress (versions up to and including 28.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The bookly_get_form_id handler blindly stores an attacker-controlled order_id into a booking session. The bookly_render_complete handler then trusts this session ...