Beschreibung
Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pending state with null last_error values.
CVSS 4.3EPSS 0.192%Risiko 0.44
Quelle öffnen- Veröffentlicht
- 2026-06-30 23:17:30
- Betroffene Versionen
- <12.128.2
- Typ
- Kritische Software
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N