CVE-2026-56328

Capgo - Integrity Issue in Release Routing via Multiple Public Channels

CVSS 7.1 HIGHEPSS 0.2%CWE-670

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

30 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Capgo · Capgo

Referências

https://github.com/Cap-go/capgo/security/advisories/GHSA-3cmp-pm5x-8464 https://www.vulncheck.com/advisories/capgo-integrity-issue-in-release-routing-via-multiple-public-channels