CVE-2026-56217 Details

A policy bypass vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows app-scoped API keys to downgrade encrypted bundles to a non-encrypted state, bypassing organization-enforced policies. The issue arises because the database only enforces bundle encryption requirements on insertion, leaving a gap that can be exploited by directly updating the app_versions table via PostgREST. This manipulation clears important fields, undermining over-the-air security controls.

The vulnerability can be remediated by applying the same encrypted-bundle invariant on updates to the public.app_versions table, blocking any changes that would clear or invalidate the session_key when the organization enforces encrypted bundles. Additionally, key_id should be validated against the required_encryption_key during updates.