CVE-2026-56231

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder commands with the server-held builder API key. An authenticated user with the app.build_native permission for any app they control can start or cancel arbitrary builder jobs belonging to other tenants by supplying a victim jobId, resulting in cross-tenant build sabotage (denial of service), unauthorized compute actions, and potential billing impact.

• CWE-285

• https://github.com/Cap-go/capgo/security/advisories/GHSA-72j4-9qp5-hfrg
• https://www.vulncheck.com/advisories/capgo-broken-object-level-authorization-in-build-job-control-via-jobid-parameter
• https://github.com/Cap-go/capgo/security/advisories/GHSA-72j4-9qp5-hfrg

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56226Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase Po…8.7
• CVE-2026-56227Capgo before 12.128.2 contains a server-side request forgery…5.4
• CVE-2026-56228Capgo before 12.128.2 fails to enforce a maximum value on th…6.9
• CVE-2026-56229Capgo before 12.128.2 contains an authorization bypass vulne…7.1
• CVE-2026-5623A vulnerability was identified in hcengineering Huly Platfor…6.3
• CVE-2026-56230Capgo before 12.128.2 contains a broken object level authori…8.8
• CVE-2026-56232Capgo before 12.128.2 fails to enforce limited_to_orgs and l…8.8
• CVE-2026-56233Capgo before 12.128.2 contains a path traversal vulnerabilit…8.7
• CVE-2026-56234Capgo before 12.128.2 contains a credential validation vulne…6.9
• CVE-2026-56235Cap-go capgo before 12.128.2 contains an authorization bypas…6.9
• CVE-2026-56236Capgo CLI before 12.128.2 contains arbitrary file overwrite …6.8
• CVE-2026-56237Capgo before 12.128.2 contains a broken authentication vulne…9.3