Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-56328Capgo - Integrity Issue in Release Routing via Multiple Public Channels

Medium 6.5

In plain English

A medium-severity security flaw in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-670 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-3cmp-pm5x-8464) vendor-advisory
VulnCheck Advisory: Capgo - Integrity Issue in Release Routing via Multiple Public Channels third-party-advisory