CVE-2026-88864 Capgo SSO Provider Authentication Bypass via PostgREST Direct Write

Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...

CVE-2026-88863

capgo.app (npm package capgo) through version 12.207.1 contains a privilege escalation vulnerability in the validateInvite() function within supabase/functions/_backend/private/invite_new_user_to_org.ts. The function fails to compare the caller's role rank against the requested role, allowing an ...

CVE-2026-88862 Capgo API Key Manager Authentication Bypass via x-limited-key-id

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

CVE-2026-88863 capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles...

CVE-2026-88861 Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization

Capgo Cap-go/capgo.app contains an authentication bypass affecting all versions no patched version available at time of publication. The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor tha...

PT-2026-89375

Capgo capgo.app fails to restrict direct write access to the public.sso providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce sso=true, bypassing the intended backend SSO provisioning route...

CVE-2026-88864: Improper Access Control

Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...

PT-2026-89374

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/ backend/private/invite new user to org.ts. The POST /private/invite new user to org endpoint only requires the org.update...

CVE-2026-88863: Improper Privilege Management

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles...

PT-2026-89372

Capgo Cap-go/capgo.app contains an authentication bypass affecting all versions no patched version available at time of publication. The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor tha...

CVE-2026-85693

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

EUVD-2026-71142

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

Malicious Package

Overview @quantixfinance/supabase is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-85693: Authorization Bypass Through User-Controlled Key

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

PT-2026-85579

Name of the Vulnerable Software and Affected Versions Chatbot UI affected versions not specified Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because...

CVE-2026-77071

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that...

CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that...

CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that...