Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-56299

Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Capgo Capgo

Default version status: unaffected

  • 0 to < 12.128.2affected
  • 12.128.2unaffected

References