CVE-2026-56334

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pending state with null last_error values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56334

EUVD

EUVD-2026-40442

Affected Vendors & Products

Vendor	Product	Version / Range
capgo	capgo	to 12.128.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2, where there is a missing UPDATE row-level security policy on the build_requests table.

Because of this missing policy, API-key and anonymous users cannot persist builder status updates.

Attackers can exploit this to cause build status and error details to remain unpersisted, resulting in build_requests rows being stuck in a pending state with null last_error values.

Impact Analysis

The impact of this vulnerability is that build status updates and error details may not be saved correctly.

This can cause build requests to remain indefinitely in a pending state without proper error information.

As a result, it may lead to confusion, delays, or failures in build processes that rely on accurate status reporting.

Hi! I’m here to help you understand CVE-2026-56334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70