What is GHSA-wx33-g984-7g82?

GHSA-wx33-g984-7g82 is a security advisory published by GitHub Security Advisories with Medium severity. Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table,...

Which CVE IDs does GHSA-wx33-g984-7g82 cover?

GHSA-wx33-g984-7g82 covers the following CVE IDs: CVE-2026-56334. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wx33-g984-7g82?

GHSA-wx33-g984-7g82 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-wx33-g984-7g82MediumCVSS 4.3

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table,...

Vendor

GitHub Security Advisories

Published

July 1, 2026

Last Modified

July 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-56334 →

📋 Description

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pending state with null last_error values.

🔗 References (4)

https://github.com/Cap-go/capgo/security/advisories/GHSA-gc46-h5j6-qp6q
https://nvd.nist.gov/vuln/detail/CVE-2026-56334
https://www.vulncheck.com/advisories/capgo-missing-update-rls-policy-for-build-status-persistence
https://github.com/advisories/GHSA-wx33-g984-7g82