Capgo EUVD-2026-40439

Exploitation requires authorized low-privilege access as an app or channel manager within the Capgo project (PR:L) - this is not remotely exploitable by an anonymous outsider. The concrete prerequisite is the ability to create or mark multiple public channels for the same app and platform, combined with the presence of clients that send unnamed /updates requests (i.e. without an explicit defaultChannel). What limits exploitation: an attacker must already hold channel-management privileges, clients that always specify their channel are unaffected, and only deployments running Capgo before 12.128.2 are vulnerable. No end-user interaction is needed (UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scoring 7.1 cleanly matches the description: network-reachable, low complexity, requires low privileges (an authorized app/channel manager), and yields a pure integrity impact with no confidentiality or availability loss. This is a trust-boundary/insider-abuse issue rather than an externally weaponizable RCE - exploitation is gated behind legitimate management access to the Capgo project, which substantially narrows the real-world threat population. No EPSS score was provided, KEV status is negative, and no POC is referenced, so all signals point to a genuine but bounded integrity risk rather than an internet-wide emergency. The tag 'Information Disclosure' conflicts with the CVSS vector, which sets VC:N (no confidentiality impact) and VI:H (integrity only) - the tag appears mislabeled; treat this as an integrity/routing-manipulation issue, not data disclosure.

A user with channel-manager rights on a Capgo project creates a second public channel for the same app and platform pointing at a bundle of their choosing. Clients that poll /updates without naming a channel are silently resolved to the attacker's hidden 'winner' channel and download the substituted bundle. No public POC is identified, and the action requires legitimate low-privilege management access (PR:L).