Skip to content
Threat Feed
Subscribe

Vendor

Cap-Go

3 briefs RSS
high advisory

CVE-2026-56226 - Capgo Unauthenticated Data Exposure via Supabase PostgREST RPC

CVE-2026-56226 details a high-severity vulnerability in Capgo versions prior to 12.128.2 that exposes a Supabase PostgREST RPC function, `public.get_orgs_v6`, to unauthenticated attackers, allowing them to retrieve sensitive user organization membership and PII by supplying an arbitrary user UUID.

Capgo vulnerability api-exploitation data-exfiltration webserver supabase
1r 2t 1c
medium advisory

CVE-2026-56081: Cap-go Authentication Logic Flaw Leading to Account Takeover

An authentication logic flaw in Cap-go versions prior to 12.128.2 allows attackers to register an account with a victim's unverified email address, then enable two-factor authentication on this pre-registered account to gain full control, read/modify data, enforce organization-level policies, and deny the legitimate user access.

Cap-go < 12.128.2 account-takeover authentication-bypass web-application logic-flaw cloud
2r 2t
high advisory

CVE-2026-56073: Cap-go OTP Verification Authentication Bypass

Cap-go versions prior to 12.128.2 are susceptible to an authentication bypass vulnerability (CVE-2026-56073) in OTP verification that allows attackers to manipulate server responses to falsely mark verification successful, leading to unauthorized 2FA enablement and subsequent account takeover.

Cap-go authentication-bypass web-application vulnerability account-takeover cve network-attack
2r 2t