CVE-2026-56314

Summary

Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.

Affected Software

VendorProductVersion RangeStatus
CapgoCapgo0 < 12.128.12affected
CapgoCapgo12.128.12unaffected

Weaknesses

  • CWE-672: Operation on a Resource after Expiration or Release

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References