CVE-2026-56328

7.1 highEPSS 0.3%

High (7.1). EPSS 0.3% chance of exploitation in the next 30 days.

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-11-01)
CWE: CWE-670
Published: 2026-06-30
Modified: 2026-07-01
Record from: the NVD, synced 2026-10-19

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-3cmp-pm5x-8464
https://www.vulncheck.com/advisories/capgo-integrity-issue-in-release-routing-via-multiple-public-channels
https://github.com/Cap-go/capgo/security/advisories/GHSA-3cmp-pm5x-8464

Check your stack JSON