CVE-2026-56323

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An information disclosure issue exists in the '/functions/v1/channel self' endpoint. Unauthenticated remote attackers can send GET requests using arbitrary app id parameters to enumerate non-public channel names, determine the existence of applications across different tenants, and leak billing and subscription status without requiring authentication or device binding.

Recommendations Update to version 12.128.2 or later. As a temporary workaround, restrict access to the '/functions/v1/channel self' endpoint to minimize the risk of information disclosure.