CVE-2026-56314
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Jun 22, 2026
Vendor
unknown
Description
Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.