CVE-2026-56309

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Insufficient enforcement of plan and quota restrictions occurs at the '/files/upload/attachments' endpoint. This allows applications that should be blocked by their current plan to create publicly readable R2 objects (cloud storage objects). By using upload-scoped API keys, attackers can bypass plan checks to upload arbitrary attachments. These files persist independently of normal bundle metadata and remain even after an app is deleted, which can lead to storage and bandwidth abuse.

Recommendations Update to version 12.128.2 or later. Restrict access to the '/files/upload/attachments' endpoint to minimize the risk of exploitation.