CVE-2026-56324CWE-770

Capgo - Rate Limit Bypass via User-Controlled device_id Parameter

High · published June 22, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00465 · 39.3th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-06-22T21:04Z
EPSS history
Timeline
  • 22 JUN 21:04Z
    Capgo - Rate Limit Bypass via User-Controlled device_id Parameter
    cvelistv5