Information Disclosure Vulnerability in Capgo by Capgo

CVE-2026-56322

What is CVE-2026-56322?

The Capgo application prior to version 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint. This vulnerability allows attackers to interact with the defaultChannel parameter without sufficient privacy restrictions. As a result, unauthenticated attackers can probe for private channel names and determine which channels are valid based on variances in the responses from the server. This behavior potentially leads to the leakage of sensitive version details and configurations that are specific to the platform, offering a pathway for further exploitation. It is crucial for users of Capgo to review their systems and apply the appropriate updates to mitigate this risk.

References