CVE-2026-56302

MediumCVSS 6.5/10Last modified Jun 25, 2026

Description

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-563037.5Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFIN CVE-2026-563046.5picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-CVE-2026-563058.3Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user p CVE-2026-563066.4Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcemen CVE-2026-563074.3Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path th CVE-2026-563087.3Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing emai CVE-2026-563095.4Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to crea CVE-2026-56317.3A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend CVE-2026-563104.3Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API CVE-2026-563115.3Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthe CVE-2026-563126.5Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before capt CVE-2026-563138.1Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise admi