CVE-2026-56314: Capgo Deleted App Version Bypass – HIGH Severity Flaw

Technical summary

The vulnerability exists in Capgo's /updates resolution endpoint. When the system joins channel configurations with available app versions to determine what update a device should receive, it fails to apply a filter for deleted app versions (the app_versions.deleted field). This allows deleted bundle records to remain in the query result set and become selectable for deployment. An authenticated user with channel management privileges can exploit this logic gap to republish bundles that should be inaccessible, bypassing intended version lifecycle controls. The CVSS score of 7.1 reflects the combination of network-accessible attack surface, low complexity, and integrity impact tempered by the authentication requirement.

Business impact

Organizations relying on Capgo for app deployment face a supply-chain-like risk where app updates can be rolled back to insecure or defective versions without legitimate control. This undermines version management and security patching workflows. An attacker with compromised or malicious insider credentials could deploy known-vulnerable versions to a user base, negating the security benefits of patches already delivered. For SaaS platforms using Capgo, this could result in widespread user exposure to fixed vulnerabilities, reputation damage, and potential compliance violations if security updates are implicitly assumed to be permanent. The attack does not require end-user interaction or out-of-band network access, making it efficient once credentials are compromised.

Affected systems

Capgo versions prior to 12.128.12 are vulnerable. Organizations running Capgo deployments should identify their current version and determine if they have released and then deleted any app versions. Particular risk applies to deployments where access to channel management is shared among multiple team members or service accounts, increasing the likelihood of credential compromise or misuse.

Exploitability

Exploitability is moderate-to-high in practice. The attack requires valid Capgo authentication (PR:L), but no additional privileges beyond basic channel access are needed. The attacker surface is network-accessible (AV:N) with low complexity (AC:L). No user interaction is required on the attacker's side. However, the real-world impact depends on how many organizations have (1) adopted Capgo, (2) deleted app versions intentionally, and (3) exposed channel management credentials. The vulnerability has not been flagged as actively exploited in the wild as of publication, but the simplicity of the exploit path means defensive action should not be deferred.

Remediation

Update Capgo to version 12.128.12 or later immediately. This patch introduces proper filtering of deleted versions in the channel join logic, ensuring removed bundles cannot be selected for deployment. Organizations should also audit recent deployment history to confirm whether any outdated or deleted versions were redeployed between the time they were deleted and the patch is applied. Review access controls for channel management roles and rotate any credentials that may have been shared or exposed.

Patch guidance

Capgo should be upgraded to 12.128.12 or any release newer than that version. Verify the patch by confirming the app_versions.deleted filter is now enforced in your channel version resolution queries. Consult the official Capgo release notes and security advisory for any breaking changes or additional mitigations. If you operate a self-hosted Capgo instance, ensure your deployment tooling pulls the patched version; do not pin to an older release. After patching, a brief verification test—attempting to redeploy a known deleted version—can confirm the fix is in place.

Detection guidance

Monitor Capgo logs for attempts to deploy app versions with deletion timestamps or versions marked as inactive. Alert on any channel update operations that reference bundle IDs outside the active version set. If your Capgo instance provides audit logging, look for pattern changes in which versions are being selected for distribution, especially if previously-retired versions reappear. Network-based detection is less practical here; focus instead on Capgo's internal telemetry and access logs. Correlate deployment events with your actual release calendar to identify anomalies.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.1) and should be prioritized because it directly undermines software supply-chain integrity—a foundational security control. While it requires authentication, the impact (integrity of all deployed app versions) is severe and affects end-user security posture. Organizations that have implemented strict version lifecycle policies (delete old versions after patching) face elevated risk if those controls are bypassed. The fix is straightforward and no known workarounds exist, making patching the clear immediate action.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) is driven by: (1) Network-accessible attack surface (AV:N) – the /updates endpoint is reachable over the network; (2) Low attack complexity (AC:L) – the exploit requires no special conditions or timing; (3) Low privileges required (PR:L) – authentication is needed, but standard user/channel-admin roles suffice; (4) No user interaction (UI:N) – the attacker alone triggers the malicious deployment; (5) High integrity impact (I:H) – the attacker can inject arbitrary old code into the update stream; (6) Low availability impact (A:L) – in edge cases, deploying non-functional old versions could degrade service. The score is not critical because: (a) it is not unauthenticated, (b) it does not provide confidentiality leakage, and (c) it does not offer direct system compromise without subsequent user installation.

Frequently asked questions