CVE-2026-56217: Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update
Capgo before 12.128.2 contains a policy bypass vulnerability in appversions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the appversions table via PostgREST to clear sessionkey and keyid fields, bypassing organization-enforced encrypted-bundle policies and weakening OTA security controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
If upgrading is not immediately possible, restrict app-scoped API keys from being able to access PostgREST endpoints that allow updating the app_versions table (so attackers cannot clear session_key and key_id or downgrade encrypted bundles to a non-encrypted state).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56217?
The severity of CVE-2026-56217 is rated as medium with a score of 5.3.
How do I fix CVE-2026-56217?
To fix CVE-2026-56217, upgrade Capgo to version 12.128.2 or later.
What vulnerability does CVE-2026-56217 describe?
CVE-2026-56217 describes a policy bypass vulnerability that allows attackers to downgrade encrypted bundles via PostgREST.
Who is affected by CVE-2026-56217?
Users of Capgo versions prior to 12.128.2 are affected by CVE-2026-56217.
What are the attack vectors for CVE-2026-56217?
CVE-2026-56217 can be exploited by attackers with app-scoped all API keys who can directly update the app_versions table.