Authentication Bypass in Capgo via OPTIONS Request

Executive Summary

CVE-2026-56299 is an authentication bypass vulnerability in Capgo versions before 12.128.2 affecting the /build/upload/:jobId/* endpoint.

Unauthenticated attackers can send HTTP OPTIONS requests to this endpoint, which bypasses the authentication middleware and directly invokes the tusProxy logic with invalid or empty credentials.

This causes the server to consistently return 500 Internal Server Errors, regardless of whether the jobId exists, due to missing valid authentication context.

The vulnerability allows attackers to trigger these errors repeatedly, leading to request flooding and denial of service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by unauthenticated attackers to cause a denial of service (DoS) on the Capgo API by flooding the /build/upload/:jobId/* endpoint with OPTIONS requests.

Repeated triggering of 500 Internal Server Errors can overwhelm server resources, amplify logs, and disrupt normal application functionality.

Because the authentication middleware is bypassed, attackers do not need valid credentials, making the attack trivial to perform.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending unauthenticated HTTP OPTIONS requests to the /build/upload/:jobId and /build/upload/:jobId/* endpoints and observing if the server responds with consistent 500 Internal Server Errors.

A proof of concept command to test this is using curl to send an OPTIONS request without authentication headers.

• curl -X OPTIONS https://<target-host>/build/upload/<jobId>
• curl -X OPTIONS https://<target-host>/build/upload/<jobId>/*

If these commands consistently return HTTP 500 errors, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating the Capgo software to version 12.128.2 or later, where this authentication bypass vulnerability has been patched.

Until the update can be applied, consider implementing network-level controls such as blocking or rate-limiting unauthenticated OPTIONS requests to the /build/upload/:jobId/* endpoints to reduce the risk of denial-of-service attacks.

Monitoring logs for repeated 500 Internal Server Errors triggered by OPTIONS requests can also help in early detection and response.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0