CVE-2026-56328

HIGH7.1

Capgo - Integrity Issue in Release Routing via Multiple Public Channels

Published Jun 30, 2026

Modified 1 months ago

Details

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

References

ADVISORY

https://github.com/Cap-go/capgo/security/advisories/GHSA-3cmp-pm5x-8464

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-56328

ADVISORY

https://www.vulncheck.com/advisories/capgo-integrity-issue-in-release-routing-via-multiple-public-channels

CVSS Analysis

CVSS v4.0

7.1

Exploitability

Attack Vector