What is CVE-2026-56328?

CVE-2026-56328 is a medium-severity vulnerability in Capgo, classified under Always-Incorrect Control Flow Implementation. CVSS score: 6.5/10. Published 2026-06-30.

How severe is CVE-2026-56328?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Capgo

CVE-2026-56328

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

EPSS: 0.002 (16.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Capgo — versions 0, 12.128.2

Weakness classification (CWE)

CWE-670 — Always-Incorrect Control Flow Implementation

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-56328?: CVE-2026-56328 is a medium-severity vulnerability in Capgo, classified under Always-Incorrect Control Flow Implementation. CVSS score: 6.5/10. Published 2026-06-30.
How severe is CVE-2026-56328?: Medium severity. CVSS v3 base score is 6.5 out of 10.