Policy Bypass Vulnerability in Capgo by Capgo

CVE-2026-56217

What is CVE-2026-56217?

The Capgo application prior to version 12.128.2 is prone to a policy bypass vulnerability that compromises app-enforced encryption standards. Specifically, it allows attackers wielding app-scoped API keys to manipulate the app_versions table directly through PostgREST. This manipulation enables the clearing of security-critical fields such as session_key and key_id, effectively undermining organization-imposed policies intended to enforce encrypted bundle safety. This vulnerability significantly diminishes the security of over-the-air (OTA) controls, placing sensitive data at risk.

References