CVE-2026-56231: Capgo BOLA Auth Bypass Vulnerability

CVE-2026-56231 Overview

CVE-2026-56231 is a Broken Object Level Authorization (BOLA) vulnerability in Capgo versions before 12.128.2. The flaw exists in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. These handlers authorize requests using only the attacker-controlled app_id in the request body. They never verify that the jobId in the URL belongs to that app_id or to the same tenant. An authenticated user holding the app.build_native permission for any owned app can start or cancel arbitrary builder jobs across other tenants. The weakness is classified under CWE-285: Improper Authorization.

Critical Impact
Cross-tenant build sabotage, unauthorized compute consumption, and downstream billing impact against victim organizations.

Affected Products

Capgo versions prior to 12.128.2
Self-hosted Capgo build orchestration deployments
Multi-tenant Capgo instances exposing the build job control API

Discovery Timeline

2026-06-24 - CVE-2026-56231 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56231

Vulnerability Analysis

The vulnerability resides in Capgo's build job control API. Two endpoints, POST /build/start/:jobId and POST /build/cancel/:jobId, issue privileged commands to the builder service using a server-held builder API key. Before issuing those commands, the handlers must confirm that the requesting user owns the target jobId. They do not. Instead, the handler reads the app_id field directly from the request body and checks only that the caller has the app.build_native permission on that supplied app_id. The jobId from the URL path is then forwarded to the builder without any ownership or tenant binding check.

Root Cause

The root cause is missing object-level authorization between two related identifiers. The permission check operates on app_id from a client-controlled body, while the privileged action operates on jobId from the URL. There is no server-side lookup confirming that jobId belongs to app_id, nor that both belong to the same tenant or organization. This decoupling allows an attacker to satisfy the authorization gate using their own app while targeting a victim's job.

Attack Vector

An authenticated attacker with a legitimate Capgo account creates or selects any app they control that has the app.build_native permission. The attacker obtains or guesses a victim's jobId, then issues POST /build/start/:victimJobId or POST /build/cancel/:victimJobId with an app_id belonging to the attacker. The server validates permission against the attacker's app, then forwards the start or cancel command to the builder for the victim's job. The result is denial of service against active builds, forced restarts that consume victim compute quotas, and potential financial impact through unauthorized billing events.

Detection Methods for CVE-2026-56231

Indicators of Compromise

Build job state transitions where the actor's app_id does not match the owning tenant of the referenced jobId
Repeated POST /build/start/:jobId or POST /build/cancel/:jobId requests from a single account targeting jobs across multiple tenants
Unexpected build cancellations or restarts reported by tenants who did not initiate the action

Detection Strategies

Correlate API access logs to compare the app_id in the request body against the tenant that owns the jobId in the URL path
Alert on any authenticated session interacting with jobId values outside its own tenant scope
Baseline normal builder API call patterns per account and flag accounts that suddenly act on a wide range of jobId values

Monitoring Recommendations

Enable verbose audit logging for /build/start/ and /build/cancel/ endpoints, capturing actor, app_id, jobId, and resolved tenant
Forward builder API and webhook logs to a centralized analytics pipeline for cross-tenant anomaly review
Track billing and compute consumption per tenant and alert on spikes that do not correlate with that tenant's own build submissions

How to Mitigate CVE-2026-56231

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which addresses the BOLA flaw
Audit recent /build/start/ and /build/cancel/ activity for cross-tenant abuse and notify affected tenants
Rotate the server-held builder API key if logs indicate the endpoints were abused

Patch Information

Capgo has released a fixed version in 12.128.2. The patch enforces that the jobId provided in the URL is resolved server-side and validated against the authenticated user's tenant before any builder command is issued. Refer to the GitHub Security Advisory GHSA-72j4-9qp5-hfrg and the VulnCheck Advisory on the Capgo BOLA flaw for full remediation guidance.

Workarounds

Restrict the app.build_native permission to a minimum set of trusted users until patched
Place the build control endpoints behind an API gateway rule that rejects requests where the resolved tenant for jobId differs from the caller's tenant
Temporarily disable external access to /build/start/:jobId and /build/cancel/:jobId if upgrading cannot be performed immediately

bash

# Example reverse-proxy guard pseudocode
# Reject build control calls where caller tenant != jobId tenant
location ~ ^/build/(start|cancel)/([A-Za-z0-9-]+)$ {
    access_by_lua_block {
        local caller_tenant = ngx.var.http_x_tenant_id
        local job_tenant   = resolve_job_tenant(ngx.var[2])
        if caller_tenant ~= job_tenant then
            return ngx.exit(403)
        end
    }
    proxy_pass http://capgo_backend;
}