CVE-2026-56328
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jun 30, 2026
Vendor
unknown
Description
Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.