CVE-2026-56328

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description The software allows multiple public channels for the same application and platform to exist at the same time. When requests are made to the '/updates' endpoint without specifying a defaultChannel, they implicitly resolve to a single hidden winner channel. This allows an authorized app or channel manager to create an ambiguous default update state and silently influence which bundle unnamed clients receive, which compromises release routing integrity and predictability.

Recommendations Update to version 12.128.2 or later.