PT-2026-57171 · Cap Go · Cap-Go

Judel777 · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-56309

Mitre

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-56309

Produtos afetados

Cap-Go

Referências · 3

• 🔥 https://github.com/Cap-go/capgo/security/advisories/GHSA-q52j-ggvx-cr4v · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56309 · Nota de Segurança
• https://vulncheck.com/advisories/capgo-plan-bypass-via-unrestricted-attachment-upload-endpoint · Nota