CVE-2026-56314

نوع الضعف

Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.

المراجع

• https://github.com/Cap-go/capgo/security/advisories/GHSA-hqq2-87cp-j83x
• https://www.vulncheck.com/advisories/capgo-deleted-bundle-selection-via-missing-deletion-filter-in-updates-endpoint
• https://github.com/Cap-go/capgo/security/advisories/GHSA-hqq2-87cp-j83x