CVE-2026-56220
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An authorization bypass vulnerability in Capgo before version 12.128.2 allows read-only org members to insert OTA manifest rows via the public.manifest INSERT policy. Attackers with read-only access can inject malicious manifest entries with arbitrary s3_path values, which are served to devices through the unauthenticated /updates endpoint, enabling OTA metadata poisoning and potential malicious asset delivery.
Risk Assessment
The risk involves remote poisoning of OTA update metadata by an attacker with limited access, potentially leading to delivery of malicious files to end devices and compromising system integrity.
Recommendation
Immediately upgrade Capgo to version 12.128.2 or later, which includes a fix for this vulnerability. Additionally, consider restricting organization member permissions to only necessary operations.
Original NVD description (English source)
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_path values that are served to devices via the unauthenticated /updates endpoint, enabling OTA metadata poisoning and potential malicious asset delivery.