The vulnerability is an information disclosure flaw in the unauthenticated /updates endpoint of Capgo. Prior to enforcing privacy restrictions, the defaultChannel parameter is resolved, enabling attackers to enumerate private channels and learn about bundle versions and platform‑specific configuration details. By probing channel names and observing response differences, an attacker can distinguish valid channels from non‑existent ones, revealing sensitive deployment data. This weakness is classified as CWE‑200.

Capgo Capgo versions earlier than 12.128.2 are affected. Deployments of these versions that expose the /updates endpoint are susceptible to channel enumeration and data leakage.

The CVSS score of 8.7 indicates high severity. Exploitation requires no authentication and can be carried out by sending HTTP requests to the /updates endpoint, which is likely accessible from the network the application serves. The EPSS score is not available and the vulnerability is not listed in the KEV catalog. The likely attack vector is unauthenticated HTTP traffic to the vulnerable service, which allows an adversary to enumerate channels and pull configuration information.