CVE-2026-56324

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description A rate limit bypass exists in the 'channel self' endpoint. Attackers can circumvent rate limiting by rotating the user-controlled device id parameter, enabling them to send multiple requests per second. This action can flood the channel devices table, leading to database exhaustion.

Recommendations Update to version 12.128.2 or later. As a temporary workaround, restrict access to the 'channel self' endpoint or monitor the device id parameter for unusual rotation patterns.