CVE-2026-56231 Details

A broken object level authorization vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability exists in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The issue arises because the request is authorized solely based on the app_id provided in the request body, without verifying whether the jobId in the URL corresponds to that app_id or the same tenant/organization. As a result, an authenticated user with the app.build_native permission can start or cancel builder jobs belonging to other tenants, leading to cross-tenant build sabotage, unauthorized compute actions, and potential billing impacts.

To address this vulnerability, it is recommended to implement server-side checks before calling the builder start or cancel actions. This includes fetching the build request row by the jobId, verifying that it belongs to the same tenant and matches the request context, and returning a 404 error if there is a mismatch or the row is missing. Consider removing the client-supplied app_id from the start and cancel requests and instead derive it from the build request row.