CVE-2026-56302
Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jun 24, 2026
- Updated
- Jun 24, 2026
- Reserved
- Jun 20, 2026
Description
Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
CapgoCapgo |
|
References
- GitHub Security Advisory (GHSA-8hq3-gg3m-vwvr)vendor-advisory
- VulnCheck Advisory: Capgo - Unsecured Supabase Images Bucket via Missing Row Level Securitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.