CVE-2026-56322

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An information disclosure issue exists in the unauthenticated '/updates' endpoint. The system resolves the defaultChannel parameter before enforcing privacy restrictions, which allows unauthenticated attackers to enumerate private channels and leak version or configuration state. By probing private channel names, attackers can distinguish valid channels from nonexistent ones based on response differences, revealing platform-specific configuration details and assigned bundle versions.

Recommendations Update to version 12.128.2 or later. As a temporary workaround, restrict access to the '/updates' endpoint to minimize the risk of exploitation.