Capgo CVE-2026-56314

Exploitation requires an authenticated Capgo account with privileges to manage channels and bundles (CVSS PR:L), a Capgo backend running a version below 12.128.12, and at least one bundle that has been soft-deleted (app_versions.deleted set) while remaining associated with - or reassignable to - a live channel used by production devices via the /updates endpoint. Limiting factors: the attack is bounded to operators of a Capgo deployment, requires valid credentials with channel/bundle management rights rather than unauthenticated network access, has no user-interaction requirement (UI:N) but only affects devices that poll the affected channel, and impact is contained to the Capgo system itself (SC:N/SI:N/SA:N) rather than crossing into unrelated tenants or infrastructure.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) describes a network-reachable, low-complexity, authenticated attack with high integrity impact and low availability impact on the vulnerable system only - consistent with an authenticated channel/bundle operator being able to influence which code reaches devices, rather than an unauthenticated takeover. There is no CVSS 3.1 vector, no EPSS score, no KEV listing, and no POC reference in the supplied data, so real-world exploitation pressure appears low and likely targeted to operators of Capgo deployments who want to override their own deletion workflow or who compromise an account with channel-management rights. The CWE-672 framing and description align cleanly: this is a missing-filter logic bug, not a memory-safety or auth-bypass issue, so impact is bounded by what an already-authenticated channel manager can push. Net assessment: a real correctness/integrity bug worth patching promptly for any Capgo operator, but not a drop-everything emergency in the absence of KEV or EPSS signal.

An attacker with a low-privileged channel-management account on a Capgo instance - either a malicious insider or someone who compromised such an account - marks a previously-pulled bundle as deleted in the UI but then reassigns or keeps it associated with a production channel. Because the /updates join omits the app_versions.deleted filter, devices polling that channel continue to receive the supposedly-deleted bundle, letting the attacker silently re-deploy a withdrawn, vulnerable, or backdoored version of the mobile app code. No public exploit code is referenced in the available data.