CVE-2026-100621

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100619

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

EUVD-2026-87716

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100621

Capgo (capgo.app ) is affected by an incomplete access-control and content-lock enforcement issue across all versions . The enforce_encrypted_bundle_trigger / check_encrypted_bundle_on_insert content lock in supabase/schemas/prod.sql incorrectly exempts app_versions rows where the previous storag...

CVE-2026-100621 capgo.app Content-Lock Bypass via r2-direct Bundle Mutation

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100621 capgo.app Content-Lock Bypass via r2-direct Bundle Mutation

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100619 Capgo OTA Manifest Poisoning via app_versions.manifest Bypass

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

EUVD-2026-87714

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

CVE-2026-100619

The Capgo (capgo.app) platform is vulnerable to OTA manifest poisoning because row-level security policies on the public.manifest table can be bypassed indirectly. An attacker with an app-scoped upload/write/all API key or write+ rights can update public.app_versions.manifest for versions using t...

CVE-2026-100621: Improper Access Control

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100619: Incorrect Privilege Assignment

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

PT-2026-99292

Name of the Vulnerable Software and Affected Versions Capgo capgo.app affected versions not specified Description An incomplete access-control and content-lock enforcement issue exists where the enforce encrypted bundle trigger and check encrypted bundle on insert locks exempt rows in app version...