CVE-2026-56217

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description A policy bypass exists in the app versions update enforcement. This issue allows users with app-scoped API keys to downgrade encrypted bundles to a non-encrypted state. An attacker possessing app-scoped all API keys can directly update the app versions table via PostgREST to clear the session key and key id fields. This action bypasses organization-enforced encrypted-bundle policies and weakens Over-the-Air (OTA) security controls.

Recommendations Update to version 12.128.2 or later.