CVE-2026-56324: Capgo

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.

Affected products

• Capgo Capgo: before 12.128.2 (fixed in 12.128.2)

Published 2026-06-22. Last modified 2026-06-24.