CVE-2026-56302 Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security
Unauthenticated attackers can read, insert, and delete app icons in Capgo's Supabase bucket due to missing Row Level Security, leaking sensitive IDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56302?
CVE-2026-56302 is a medium-severity missing authorization vulnerability in Capgo, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.
Weakness: CWE-284
Which versions are affected by CVE-2026-56302?
How do I fix CVE-2026-56302?
No fix has been published for CVE-2026-56302 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56302 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56302 exists.
Sources
Also known as GHSA-8hq3-gg3m-vwvr.