CVE-2026-56299
MEDIUMCapgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint
Title source: cnaDescription
Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GHSA Advisory GHSA-6c7m-4223-446j
https://github.com/Cap-go/capgo/security/advisories/GHSA-6c7m-4223-446j
Third Party Advisory third-party-advisory
VulnCheck Advisory: Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint
https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unauthenticated-options-request-to-build-upload-endpoint
Scores
CVSS v3
5.3
EPSS
0.0039
EPSS Percentile
31.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-306
Status
published
Products (2)
Capgo/Capgo
< 12.128.2
Capgo/Capgo
12.128.2
Published
Jun 21, 2026
Tracked Since
Jun 21, 2026