PT-2026-51409 · Cap Go · Cap-Go

Judel777 · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-56314

NVD

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app versions.deleted filter in channel version joins.

Fix

Weakness Enumeration

CWE-672

Related Identifiers

CVE-2026-56314

Affected Products

Cap-Go

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56314 · Security Note
• https://github.com/Cap-go/capgo/security/advisories/GHSA-hqq2-87cp-j83x · Vendor Advisory
• https://vulncheck.com/advisories/capgo-deleted-bundle-selection-via-missing-deletion-filter-in-updates-endpoint · Note