CVE-2026-56229

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authorization bypass exists in the '/build/status' and '/build/logs' endpoints. Attackers can access build jobs belonging to different applications by providing a mismatched app id and job id combination. This allows limited API keys, which are normally restricted to a single application, to retrieve build status and logs from other applications by using an authorized app id alongside a job id from an unauthorized application. This exposure may include sensitive build information, metadata, and potentially credentials.

Recommendations Update to version 12.128.2 or later.