PT-2026-51412 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-22 · Atualizado 2026-06-22 · CVE-2026-56324

NVD

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device id parameter. Attackers can send multiple requests per second by changing device id values to flood the channel devices table and cause database exhaustion.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-56324

Produtos afetados

Cap-Go

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56324 · Nota de Segurança
• https://vulncheck.com/advisories/capgo-rate-limit-bypass-via-user-controlled-device-id-parameter · Nota
• https://github.com/Cap-go/capgo/security/advisories/GHSA-77p2-9rcr-5w27 · Aviso do Fabricante