CVE-2026-56328

Capgo - Integrity Issue in Release Routing via Multiple Public Channels

CVSS 7.1 HIGHEPSS 0.2%CWE-670

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

30 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

Capgo · Capgo

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-3cmp-pm5x-8464 https://www.vulncheck.com/advisories/capgo-integrity-issue-in-release-routing-via-multiple-public-channels