CVE-2026-56324 — Capgo - Rate Limit Bypass via User-Controlled device_id Parameter
Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled d…
Published: 2026-06-22 · CVSS: 8.8 · CVSS 4.0
Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7