---
id: CVE-2026-56229
title: >-
  Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status
  and /build/logs
summary: >-
  Capgo before 12.128.2 contains an authorization bypass vulnerability in the
  /build/status and /build/logs endpoints that allows attackers to access build
  jobs belonging to different applications by supplying a mismatched app_id and
  job_i…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-22T10:47:44.209630Z'
exploitAvailable: true
published: '2026-06-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:40.239Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56229'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-2fw5-mcrx-wcqw'
    label: GitHub Security Advisory (GHSA-2fw5-mcrx-wcqw)
  - url: >-
      https://www.vulncheck.com/advisories/capgo-cross-app-build-job-access-via-app-id-job-id-mismatch-in-build-status-and-build-logs
    label: >-
      VulnCheck Advisory: Capgo - Cross-App Build Job Access via app_id/job_id
      Mismatch in /build/status and /build/logs
tags:
  - cve.org
  - exploit-available
epss: 0.00375
epssPercentile: 0.31763
ingestedAt: '2026-11-08T14:51:22.365Z'
---

## Overview

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched app_id and job_id combination. Limited API keys restricted to a single app can retrieve build status and logs from other apps by providing an authorized app_id while using a job_id from an unauthorized app, exposing sensitive build information including logs, metadata, and potentially credentials.

## Affected

- `Capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.