CVE-2026-56229 Overview
CVE-2026-56229 is an authorization bypass vulnerability in Capgo versions before 12.128.2. The flaw resides in the /build/status and /build/logs endpoints, which fail to validate that the supplied job_id belongs to the authorized app_id. Attackers holding a limited API key scoped to a single application can submit a mismatched app_id and job_id pair to retrieve build jobs owned by other applications. Successful exploitation exposes build logs, metadata, and potentially embedded credentials from unrelated tenants. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated attackers with a single-app API key can read build status and logs from any other application, leaking sensitive build artifacts and credentials.
Affected Products
- Capgo versions prior to 12.128.2
- Capgo /build/status endpoint
- Capgo /build/logs endpoint
Discovery Timeline
- 2026-06-21 - CVE-2026-56229 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-56229
Vulnerability Analysis
The vulnerability is an Insecure Direct Object Reference (IDOR) in Capgo's build management API. The /build/status and /build/logs endpoints accept both app_id and job_id parameters from the client. The authorization logic verifies that the caller's API key has access to the supplied app_id but does not verify that the supplied job_id actually belongs to that app_id. As a result, the application trusts the relationship between the two identifiers without enforcing it server-side.
This design flaw is classified under CWE-639, where authorization decisions rely on user-controlled identifiers. Because build logs frequently contain environment variables, signing keys, deployment tokens, and source paths, the disclosed data can extend an attacker's reach well beyond the original tenant.
Root Cause
The root cause is missing cross-field validation in the build job lookup logic. The endpoint authenticates the API key against app_id, retrieves the build record by job_id alone, and returns the record without confirming job.app_id == request.app_id. Any limited API key can therefore act as an oracle for build jobs across the entire platform.
Attack Vector
An attacker provisions a legitimate Capgo account with a limited API key scoped to an application they control. They then issue requests to /build/status or /build/logs supplying their own authorized app_id alongside a job_id belonging to a victim application. The server returns the victim's build status and full log output. job_id values can be enumerated or harvested from public references, GitHub issues, or sequential identifiers.
The vulnerability is described in the GitHub Security Advisory GHSA-2fw5-mcrx-wcqw and the VulnCheck Advisory. No public proof-of-concept code has been released.
Detection Methods for CVE-2026-56229
Indicators of Compromise
- Requests to /build/status or /build/logs where the supplied app_id does not match the app_id associated with the returned job_id in backend records.
- API keys issuing a high volume of requests with varying job_id values against a static app_id.
- Successful build log retrievals correlated with API keys that have never built the referenced job.
Detection Strategies
- Replay historical access logs and join build job records to identify any request where request.app_id != job.app_id for the returned job_id.
- Alert on enumeration patterns against /build/logs and /build/status, particularly sequential or randomized job_id parameters from a single API key.
- Monitor for API keys retrieving build logs containing secrets or credentials shortly before anomalous authentication events in connected services.
Monitoring Recommendations
- Enable verbose access logging for all /build/* endpoints, capturing the API key identifier, app_id, and job_id for every request.
- Forward Capgo application logs to a centralized analytics platform and correlate API key activity with downstream credential usage.
- Track per-API-key request rates and distinct job_id counts to surface enumeration behavior.
How to Mitigate CVE-2026-56229
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which enforces ownership validation between app_id and job_id.
- Rotate any secrets, signing keys, or deployment tokens that may have appeared in build logs prior to patching.
- Audit historical build log access to identify any cross-application reads and notify affected tenants.
- Revoke and reissue limited API keys with unexplained access patterns against /build/status or /build/logs.
Patch Information
The maintainers fixed the issue in Capgo 12.128.2. The patch adds server-side validation ensuring that the job_id supplied in /build/status and /build/logs requests belongs to the same app_id the API key is authorized for. Operators running self-hosted Capgo deployments should pull the updated release and redeploy. Details are available in the GitHub Security Advisory GHSA-2fw5-mcrx-wcqw.
Workarounds
- If immediate patching is not possible, restrict /build/status and /build/logs at a reverse proxy by requiring an additional ownership check before forwarding requests.
- Disable issuance of limited (per-app) API keys until the upgrade is applied, allowing only administrative keys that are tightly controlled.
- Treat all historical build logs as potentially exposed and rotate embedded secrets as a precaution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
