CVE-2026-56314 Overview
CVE-2026-56314 affects Capgo versions before 12.128.12. The vulnerability resides in the /updates endpoint resolution logic, which fails to filter deleted application versions when joining channels. As a result, deleted bundles remain selectable and can continue to be deployed to client devices. The flaw is classified as [CWE-672] (Operation on a Resource after Expiration or Release). An authenticated attacker with low privileges can exploit the missing app_versions.deleted filter to push bundles that administrators believed were removed from circulation.
Critical Impact
Attackers can continue deploying bundles that were marked as deleted, undermining version retraction controls and allowing distribution of code that should no longer be reachable through update channels.
Affected Products
- Capgo versions prior to 12.128.12
- Self-hosted Capgo deployments using the /updates endpoint
- Capgo channel-based update distribution components
Discovery Timeline
- 2026-06-22 - CVE-2026-56314 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-56314
Vulnerability Analysis
Capgo distributes over-the-air bundle updates to Capacitor applications through channels that map to specific application versions. When a client requests an update through the /updates endpoint, the backend joins channel records with the app_versions table to determine the bundle to return. The join logic in versions before 12.128.12 omits a predicate on the app_versions.deleted column. Bundles soft-deleted by administrators remain joinable and selectable as valid update candidates.
The issue falls under CWE-672, where the system operates on a resource after its logical release. Administrators who delete a bundle expect that bundle to be unavailable for deployment, but the missing filter allows the deleted record to continue serving traffic.
Root Cause
The root cause is an incomplete query filter. The channel-to-version join clause does not constrain results to records where app_versions.deleted IS NULL or deleted = false. Soft-deletion is implemented at the schema level but not enforced at the read path used during update resolution.
Attack Vector
Exploitation requires network access and low-privileged authentication to the Capgo instance. An attacker who can associate a deleted bundle with a channel, or who controls a channel referencing a previously deleted version, can cause that bundle to be served to client devices. The vulnerability provides high integrity impact because the application code distributed to end users may differ from what administrators intend.
No verified proof-of-concept code is published. See the GitHub Security Advisory for vendor technical details.
Detection Methods for CVE-2026-56314
Indicators of Compromise
- Update responses from /updates referencing bundle IDs that exist in app_versions with a non-null deleted timestamp.
- Client telemetry reporting bundle versions that administrators previously removed from the dashboard.
- Channel configuration records pointing to version_id values that are marked deleted in the database.
Detection Strategies
- Run a database audit query joining channels to app_versions and flagging rows where app_versions.deleted is set.
- Compare bundles returned by /updates against the current list of non-deleted bundles in the admin console.
- Review web access logs for /updates requests followed by downloads of bundle artifacts that correspond to retracted versions.
Monitoring Recommendations
- Enable application-level logging of bundle IDs served by the /updates endpoint and alert on any ID whose deleted field is populated.
- Track changes to the channels table to detect assignments of deleted versions.
- Monitor client-side update metrics for unexpected rollbacks to older or retracted bundle versions.
How to Mitigate CVE-2026-56314
Immediate Actions Required
- Upgrade Capgo to version 12.128.12 or later on all self-hosted instances.
- Audit existing channels and remove references to any bundles whose deleted flag is set.
- Rotate API keys used for channel management if unauthorized channel modifications are suspected.
Patch Information
The fix is included in Capgo 12.128.12. The patch adds the missing app_versions.deleted filter to the channel join performed during /updates resolution, preventing soft-deleted bundles from being returned to clients. Refer to the GitHub Security Advisory GHSA-hqq2-87cp-j83x and the VulnCheck Security Advisory for vendor remediation details.
Workarounds
- Hard-delete bundle records instead of relying on soft-deletion until the patch is applied.
- Restrict channel modification permissions to a minimal set of trusted administrators.
- Place the /updates endpoint behind an authenticated proxy that validates the served bundle ID against an allowlist of active versions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
