CVE-2026-56220

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N                                    

Vulnerability Description

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_path values that are served to devices via the unauthenticated /updates endpoint, enabling OTA metadata poisoning and potential malicious asset delivery.

Vulnerability Details

Published Date

July 08, 2026

Last Modified

July 08, 2026

CWE ID

CWE-863

Source

NVD

Vendor

Capgo

Product

Capgo

External References

https://github.com/Cap-go/capgo/security/advisories/GHSA-vmgg-crr8-887p
https://www.vulncheck.com/advisories/capgo-unauthorized-manifest-insertion-via-read-only-org-member
https://github.com/Cap-go/capgo/security/advisories/GHSA-vmgg-crr8-887p

CVE-2026-56220

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment