---
id: CVE-2026-56299
title: >-
  Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload
  Endpoint
summary: >-
  Capgo before 12.128.2 contains an authentication bypass vulnerability in the
  /build/upload/:jobId/* endpoint that allows unauthenticated attackers to
  trigger consistent 500 errors. Remote attackers can send OPTIONS requests to
  bypass aut…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-306
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-23T14:00:21.259811Z'
published: '2026-06-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:55.917Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56299'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-6c7m-4223-446j'
    label: GitHub Security Advisory (GHSA-6c7m-4223-446j)
  - url: >-
      https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unauthenticated-options-request-to-build-upload-endpoint
    label: >-
      VulnCheck Advisory: Capgo - Denial of Service via Unauthenticated OPTIONS
      Request to /build/upload Endpoint
tags:
  - cve.org
epss: 0.00683
epssPercentile: 0.52789
ingestedAt: '2026-11-08T14:51:22.358Z'
---

## Overview

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.

## Affected

- `Capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.