CVE-2026-56314

Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.

View graph Watch Export

CVSS v3.1

7.1 HIGH

EPSS

0.43%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

ScopeUNCHANGED

ConfidentialityNONE

IntegrityHIGH

AvailabilityLOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Connections

1 relationships

CWE-672

source

Timeline

disclosure → media coverage

Jun 22, 2026

Disclosure — published as a CVE record.