PT-2026-51412 · Cap Go · Cap-Go

Judel777 · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-56324

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device id parameter. Attackers can send multiple requests per second by changing device id values to flood the channel devices table and cause database exhaustion.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-56324

Affected Products

Cap-Go

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56324 · Security Note
• https://github.com/Cap-go/capgo/security/advisories/GHSA-77p2-9rcr-5w27 · Vendor Advisory
• https://vulncheck.com/advisories/capgo-rate-limit-bypass-via-user-controlled-device-id-parameter · Note