CVE-2026-56302
Medium
Description
Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.
SeverityMedium
CVSS6.5
Exploit probability—
ProductCapgo
PublishedJun 24, 2026
First seenJun 24, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- Capgo Capgo12.128.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Capgo Capgo | v < 12.128.2 | 12.128.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.