HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-56231 — Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulner...

·Source: NIST NVD

Updated:

Executive Summary

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder comma

Analysis

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder commands with the server-held builder API key. An authenticated user with the app.build_native permission for any app they control can start or cancel arbitrary builder jobs belonging to other tenants by supplying a victim jobId, resulting in cross-tenant build sabotage (denial of service), unauthorized compute actions, and potential billing impact. CVSS Score: 7.6. Published: 2026-06-24T13:16:33.200.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56231
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

LOWVulnerability

New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking

CISA has published an advisory to inform organizations about three vulnerabilities found by a researcher in Daktronics controllers. The post New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild

A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Payments that could be abused to take over susceptible instances. "Easily exploitable vulnerability allows

CVE-2026-46817
The Hacker News
MEDIUMVulnerability

EIB issues DLT-native commercial paper on Clearstream platform

The European Investment Bank (EIB) has issued the first distributed ledger technology-native commercial paper on Clearstream’s D7 platform.

Finextra