CVE-2026-56323 — Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public c…
Published: 2026-06-22 · CVSS: 8.7 · CVSS 4.0
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary app_id parameters to disclose internal rollout channels, enumerate valid applications across tenants, and leak billing status without authentication or device binding.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7