Is CVE-2026-56335 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56335 being exploited in the wild.

How severe is CVE-2026-56335?

Medium severity, with a CVSS score of 6.5, published 10 July 2026.

Is there a fix for CVE-2026-56335?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56335 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56335?

Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56335: Capgo authorization bypass in channel configuration via PostgREST

CVE-2026-56335 · Severity: medium · CVSS 6.5 · Published 2026-07-10

Capgo, a platform for managing app updates and deployments, contained a security flaw where certain API keys could bypass intended restrictions. An attacker with a standard 'write' API key could modify sensitive channel settings that were supposed to be permanent or protected, such as whether a channel is public or if it allows emulators. This could lead to unauthorized changes in how software updates are distributed to users or the exposure of private development channels.

Technologies: Capgo. Vendors: Capgo.

Quick answers

Is CVE-2026-56335 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56335 being exploited in the wild.
How severe is CVE-2026-56335?: Medium severity, with a CVSS score of 6.5, published 10 July 2026.
Which products and versions are affected?: Capgo < 12.128.2.
Is there a fix for CVE-2026-56335?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56335 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56335?: Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in Capgo versions prior to 12.128.2 due to a flaw in the 'public.noupdate()' immutability trigger. The trigger, designed to prevent modifications to sensitive channel fields, contains a logic error that returns early (skipping checks) if 'auth.uid()' is NULL. Because API-key authenticated requests via PostgREST result in a NULL authentication ID, the immutability enforcement is bypassed. Simultaneously, the Row Level Security (RLS) UPDATE policy on the 'public.channels' table permits write-scoped API keys to perform updates. An authenticated attacker with a write-scoped API key can exploit this to modify protected attributes such as 'public', 'allow_emulator', and other security flags. The issue is resolved in version 12.128.2.

Affected products

Capgo Capgo < 12.128.2

Timeline

2026-05-07: advisory: Vendor advisory published on GitHub
2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.