CVE-2026-56231: Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter
Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled appid supplied in the request body and never verify that the jobId in the URL belongs to that appid (or the same tenant/org) before issuing privileged builder commands with the server-held builder API key. An authenticated user with the app.buildnative permission for any app they control can start or cancel arbitrary builder jobs belonging to other tenants by supplying a victim jobId, resulting in cross-tenant build sabotage (denial of service), unauthorized compute actions, and potential billing impact.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56231?
CVE-2026-56231 has a high severity rating of 7.6.
How do I fix CVE-2026-56231?
To fix CVE-2026-56231, ensure that job authorization checks are implemented based on user permissions rather than relying solely on the app_id in the request body.
What software is affected by CVE-2026-56231?
CVE-2026-56231 affects versions of Capgo prior to 12.128.2.
What type of vulnerability is CVE-2026-56231?
CVE-2026-56231 is classified as a broken object level authorization (BOLA) vulnerability.
What endpoints are vulnerable in CVE-2026-56231?
The vulnerable endpoints in CVE-2026-56231 are POST /build/start/:jobId and POST /build/cancel/:jobId.