Cyber Resilience

CVE-2026-56328

HighPublic PoC

Published: 30 June 2026

Published
30 June 2026
Modified
30 June 2026
KEV Added
—
Patch
—
CVSS Score v4 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0025 15.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-56328 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default…

more

update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

CWE(s)
CWE-670

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References