CVE-2026-56322 Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter
Unauthenticated attackers can enumerate private channels and leak version or configuration details via the /updates endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56322?
CVE-2026-56322 is a high-severity vulnerability in Capgo, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter before enforcing privacy restrictions, allowing attackers to enumerate private channels and leak version/config state. Unauthenticated attackers can probe private channel names and distinguish valid channels from nonexistent ones based on response differences, revealing assigned bundle versions and platform-specific configuration details.
Weakness: CWE-200
Which versions are affected by CVE-2026-56322?
How do I fix CVE-2026-56322?
No fix has been published for CVE-2026-56322 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56322 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56322 exists.
Sources
Also known as GHSA-53rj-6v76-ccwp, GHSA-pgmr-gw53-7f77.