CVE-2026-56314: Capgo

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.

Affected products

• Capgo Capgo: before 12.128.12 (fixed in 12.128.12)

Published 2026-06-22. Last modified 2026-06-23.