PT-2026-51409 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-22 · Atualizado 2026-06-22 · CVE-2026-56314

NVD

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app versions.deleted filter in channel version joins.

Correção

Enumeração de Fraquezas

CWE-672

Identificadores relacionados

CVE-2026-56314

Produtos afetados

Cap-Go

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56314 · Nota de Segurança
• https://github.com/Cap-go/capgo/security/advisories/GHSA-hqq2-87cp-j83x · Aviso do Fabricante
• https://vulncheck.com/advisories/capgo-deleted-bundle-selection-via-missing-deletion-filter-in-updates-endpoint · Nota