Authorization Bypass Vulnerability in Capgo Product by Capgo

CVE-2026-56229

What is CVE-2026-56229?

The Capgo platform, prior to version 12.128.2, is susceptible to an authorization bypass vulnerability that affects the /build/status and /build/logs endpoints. Attackers can exploit this flaw by providing a mismatched app_id and job_id combination, which allows access to build jobs belonging to different applications. This vulnerability enables limited API keys, which are typically restricted to a single application, to obtain sensitive build information—such as logs, metadata, and potentially credentials—from unauthorized applications. By using an authorized app_id alongside a job_id from a different application, attackers can compromise critical data information, posing serious risks to application security.

References