Capgo versions older than 12.128.2 allow an authenticated user possessing the app.build_native permission to exploit a broken object‑level authorization. The POST /build/start/:jobId and POST /build/cancel/:jobId routes verify the supplied app_id only and do not confirm that the jobId in the URL belongs to that app or tenant. Consequently, an attacker can start or cancel builder jobs owned by other tenants, leading to denial of service, unauthorized compute operations, and possible billing discrepancies. This vulnerability represents a CWE‑285 type of flaw involving improper authorization checks.

All Capgo deployments running a release older than 12.128.2 are affected, regardless of the specific host or cloud platform. The vulnerability impacts the server‑side API handling of build job control operations.

The CVSS score of 7.2 indicates a high severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker already has valid credentials with the app.build_native privilege, making the threat contingent on authenticated, non‑admin accounts. Once authenticated, the attacker can instruct the server to execute privileged builder commands on arbitrary tenant jobs, providing a direct path to denial of service and potential financial exploitation.