Technical impact
Capgo versions prior to 12.128.12 contain a flaw in the /updates endpoint where the deletion status of app versions is not respected during channel resolution. This missing filter means that bundles marked as deleted can still be queried and selected for deployment, allowing an attacker to re‑deploy code that should have been removed. The consequence is that devices may receive unwanted or malicious updates, potentially compromising integrity and availability.
Affected Systems
All installations of Capgo using versions earlier than 12.128.12 are affected. The CNA identifies the product as Capgo and the vulnerability applies to every instance of that application running a pre‑12.128.12 release.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified precisely, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to target the application's update mechanism, which is typically exposed over network interfaces, making remote exploitation plausible. Given the absence of detectable mitigations in the affected releases, the risk remains substantive until the vendor releases an update that enforces the deleted filter.
