CVE-2026-56220

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authorization bypass exists in the public.manifest INSERT policy. This flaw allows organization members with read-only access to insert Over-the-Air (OTA) manifest rows. An attacker can inject malicious manifest entries by manipulating the s3 path variable, which are then served to devices through the unauthenticated '/updates' endpoint. This leads to OTA metadata poisoning, potentially allowing the delivery of malicious assets to devices.

Recommendations Update to version 12.128.2 or later.