Skip to content
OpenAdvisories

Product · Capgo

capgo.app

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-88864

    Capgo SSO Provider Authentication Bypass via PostgREST Direct Write

    Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend…

    Capgo capgo.app