CVE-2026-56323 Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self
Unauthenticated attackers can enumerate private channels and leak app subscription status via the channel_self endpoint in Capgo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56323?
CVE-2026-56323 is a high-severity vulnerability in Capgo, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary app_id parameters to disclose internal rollout channels, enumerate valid applications across tenants, and leak billing status without authentication or device binding.
Weakness: CWE-200
Which versions are affected by CVE-2026-56323?
How do I fix CVE-2026-56323?
No fix has been published for CVE-2026-56323 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56323 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56323 exists.
Sources
Also known as GHSA-469v-6vw5-hxpq.