high7.1
CVE-2026-56314
Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable.
Impact
Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.
Affected products
| Product | Affected versions |
|---|---|
| Capgo | before 12.128.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.