Is CVE-2026-56328 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-56328?

CVE-2026-56328 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-56328

Description

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.