Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Cap-go capgo 12.128.2 Clear all filters
TI-2026-40649 CVE-2026-56284 · GHSA-9wm3-r7wr-vg47

Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC

Priority HIGH 70

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_p…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00277 Published 2026-07-08 Fixed in 12.128.2 CWE-200
TI-2026-40591 CVE-2026-56226 · GHSA-fw56-3v5m-f44w

Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC

Priority HIGH 77

Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00322 Published 2026-07-08 Fixed in 12.128.2 CWE-200