CVE-2026-56231

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Broken Object Level Authorization (BOLA) occurs when the system fails to verify if a user has permission to access a specific object. The issue exists in the 'POST /build/start/:jobId' and 'POST /build/cancel/:jobId' endpoints. The handlers authorize requests based solely on the app id provided in the request body without verifying if the :jobId in the URL belongs to that app id or the same tenant. An authenticated user with app.build native permissions for any app they control can start or cancel arbitrary builder jobs of other tenants by providing a victim's :jobId. This can lead to cross-tenant build sabotage, denial of service, unauthorized compute actions, and billing impacts.

Recommendations Update Capgo to version 12.128.2 or later.