CVE-2026-56309CWE-770

Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint

Medium · published July 10, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-10T13:57Z
EPSS history
Timeline
  • 10 JUL 13:57Z
    Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint
    cvelistv5