Is CVE-2026-56217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56217 being exploited in the wild.

How severe is CVE-2026-56217?

Medium severity, with a CVSS score of 4.3, published 8 July 2026.

Is there a fix for CVE-2026-56217?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56217 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56217?

Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56217: Capgo policy bypass in app_versions update enforcement

CVE-2026-56217 · Severity: medium · CVSS 4.3 · Published 2026-07-08

Capgo, a platform for managing over-the-air (OTA) updates for mobile applications, contains a security flaw that allows users with limited API access to bypass encryption requirements. An attacker with an app-scoped API key can downgrade encrypted software update bundles to an unencrypted state, even if the organization has policies in place to prevent this. This undermines the security of the update delivery process and could allow for the distribution of unprotected application code.

Technologies: Capgo. Vendors: Capgo.

Quick answers

Is CVE-2026-56217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56217 being exploited in the wild.
How severe is CVE-2026-56217?: Medium severity, with a CVSS score of 4.3, published 8 July 2026.
Which products and versions are affected?: Capgo < 12.128.2.
Is there a fix for CVE-2026-56217?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56217 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56217?: Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A policy bypass vulnerability exists in Capgo's backend due to improper enforcement of encryption invariants during database updates. While the system uses a database trigger to ensure bundles are encrypted upon insertion (INSERT), it fails to apply the same logic during updates (UPDATE) via PostgREST. An attacker possessing an app-scoped API key with 'all' permissions can issue a direct PostgREST PATCH request to the 'app_versions' table to clear the 'session_key' and 'key_id' fields. This effectively downgrades an existing encrypted bundle to an unencrypted state, bypassing organization-level 'enforce_encrypted_bundles' policies. The issue is resolved in version 12.128.2 by applying the encryption invariant check to both INSERT and UPDATE operations.

Affected products

Capgo Capgo < 12.128.2

Timeline

2026-05-07: advisory: GitHub Security Advisory published
2026-07-08: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.