CVE-2026-56322: Capgo Information Disclosure Vulnerability

CVE-2026-56322 Overview

CVE-2026-56322 is an information disclosure vulnerability in Capgo versions prior to 12.128.2. The unauthenticated /updates endpoint resolves the defaultChannel parameter before enforcing privacy restrictions. Attackers can enumerate private channel names and distinguish valid channels from nonexistent ones based on response differences. The flaw leaks assigned bundle versions and platform-specific configuration details to unauthenticated remote attackers. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated network attackers can enumerate private update channels and harvest bundle version and configuration metadata from any Capgo deployment running a version earlier than 12.128.2.

Affected Products

Capgo (Cap-go/capgo) versions before 12.128.2
Self-hosted Capgo update server deployments
Applications relying on the affected /updates endpoint for channel resolution

Discovery Timeline

2026-06-23 - CVE-2026-56322 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56322

Vulnerability Analysis

The vulnerability resides in the request handling logic of the unauthenticated /updates endpoint. The handler resolves the defaultChannel parameter and looks up the associated channel record before applying privacy or access-control checks. As a result, server responses vary based on whether the supplied channel name maps to an existing private channel or to no channel at all.

This behavioral divergence creates an oracle. An attacker who submits guessed channel names can observe the response shape, status, or content and infer which channels exist. Once a private channel is identified, the same endpoint returns metadata that should remain restricted, including bundle version assignments and platform-specific configuration values. The endpoint requires no authentication, so exploitation can be automated at scale against any reachable Capgo instance.

Root Cause

The root cause is an order-of-operations defect in the authorization model. The endpoint performs channel resolution and metadata assembly before evaluating whether the requester is permitted to learn anything about the channel. Privacy enforcement should precede any lookup that influences response content or timing. Because that gate is absent until after resolution, the response itself encodes information about restricted resources.

Attack Vector

Exploitation requires only network access to a vulnerable /updates endpoint. An attacker sends crafted HTTP requests that vary the defaultChannel parameter and compares responses. Differential analysis between requests for known-invalid names and candidate private names reveals valid channels. Subsequent requests retrieve version and configuration data tied to those channels. No user interaction, credentials, or prior access are needed.

Verified proof-of-concept code is not publicly available. See the GitHub Security Advisory GHSA-pgmr-gw53-7f77 and the VulnCheck Advisory for the maintainer's technical description.

Detection Methods for CVE-2026-56322

Indicators of Compromise

High-volume unauthenticated requests to /updates with varied defaultChannel parameter values from a small set of source IPs.
Sequential or dictionary-style enumeration patterns in defaultChannel values observed in web server access logs.
Repeated requests producing alternating response sizes or status codes, indicating channel-existence probing.
Requests to /updates from non-mobile-app User-Agent strings, scanners, or scripted HTTP clients.

Detection Strategies

Parse web access logs for /updates requests grouped by source IP and count unique defaultChannel values per hour.
Alert when a single client requests more than a small threshold of distinct channel names within a short window.
Compare response byte-length distributions for /updates responses to flag oracle-style probing.
Correlate enumeration activity with subsequent successful retrievals of bundle version metadata.

Monitoring Recommendations

Forward Capgo server access and application logs to a centralized analytics platform for retention and query.
Track baseline request rates against /updates and trigger anomalies on deviations.
Monitor egress of bundle configuration responses by size and frequency per source IP.
Review CDN or reverse-proxy logs for cached responses that may amplify enumeration.

How to Mitigate CVE-2026-56322

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted deployments.
Audit access logs for the /updates endpoint to identify prior enumeration attempts.
Rotate any bundle versioning or channel naming that may have been exposed if logs indicate probing.
Restrict network exposure of the update server to only required client ranges where feasible.

Patch Information

The maintainers fixed CVE-2026-56322 in Capgo 12.128.2. The patch enforces privacy and authorization checks before the defaultChannel parameter is resolved, so responses no longer differ based on the existence of private channels. Apply the upgrade through the project repository or your package manager. Patch details are documented in the GitHub Security Advisory GHSA-pgmr-gw53-7f77.

Workarounds

Place the Capgo update server behind a WAF or reverse proxy that rate-limits unauthenticated requests to /updates.
Block or throttle source IPs exhibiting enumeration patterns against the defaultChannel parameter.
Avoid using guessable or sensitive identifiers as private channel names until the patch is applied.
Where possible, restrict /updates to authenticated clients via an upstream authentication layer until the upgrade is deployed.

bash

# Configuration example: upgrade Capgo to the patched release
npm install @capgo/capgo@^12.128.2
# Verify the installed version
npm ls @capgo/capgo | grep capgo