Executive Summary

CVE-2026-56231 is a broken object level authorization (BOLA) vulnerability in Capgo versions before 12.128.2. It affects the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The vulnerability arises because the server only checks the app_id supplied in the request body, which is attacker-controlled, but does not verify that the jobId in the URL belongs to the same app_id or tenant. This means an authenticated user with the app.build_native permission for any app they control can start or cancel build jobs belonging to other tenants by supplying a victim's jobId.

This flaw allows cross-tenant build sabotage, unauthorized compute actions, and potential billing impact because the attacker can manipulate other tenants' build jobs without proper authorization.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to manipulate build jobs belonging to other tenants, leading to unauthorized actions such as denial-of-service, unauthorized compute usage, and potential billing impact.

Such unauthorized cross-tenant access and actions could result in violations of data protection and privacy regulations like GDPR or HIPAA, as it compromises tenant isolation and could lead to unauthorized access or disruption of services.

However, the provided information does not explicitly mention compliance impacts or specific regulatory consequences.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts including:

• Cross-tenant build sabotage, resulting in denial of service by starting or canceling other tenants' build jobs.
• Unauthorized compute actions, where attackers can misuse compute resources belonging to other tenants.
• Potential billing impact due to unauthorized usage of resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Capgo to version 12.128.2 or later where the broken object level authorization issue is fixed.

Additionally, ensure that the server validates that the jobId in the URL belongs to the same app_id or tenant before executing any privileged builder commands.

Restrict the app.build_native permission to trusted users only, as this permission allows starting or canceling build jobs.

Useful 0 Not Useful 0