CVE-2026-56280

Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection.

• CWE-862

• https://github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737
• https://www.vulncheck.com/advisories/cap-go-privilege-inversion-in-build-log-stream-via-sse-disconnect
• https://github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737

Published

Jun 22, 2026

Last Modified

Jun 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56275Flowise before 3.1.0 contains a server-side request forgery …7.1
• CVE-2026-56276Flowise before 3.1.2 contains a mass assignment vulnerabilit…6
• CVE-2026-56277Flowise before 3.1.2 sets Access-Control-Allow-Origin to a h…6.5
• CVE-2026-56278Flowise before 3.1.0 (affected versions 3.0.13 and earlier) …9.3
• CVE-2026-56279Capgo before 12.128.2 contains an information disclosure vul…8.7
• CVE-2026-5628A security vulnerability has been detected in Belkin F9K1015…8.8
• CVE-2026-56281Capgo before 12.128.2 contains a sql injection vulnerability…5.1
• CVE-2026-56282Capgo before 12.128.2 contains an information disclosure vul…6.9
• CVE-2026-56283Capgo before 12.128.2 contains an html injection vulnerabili…5.4
• CVE-2026-56284Capgo (Cap-go/capgo) before 12.128.2 contains an information…6.9
• CVE-2026-56285Nitter's /video media proxy endpoint fails to validate targe…8.6
• CVE-2026-56286Capgo before 12.128.2 contains an authentication bypass vuln…8.1