Cap-go prior to version 12.128.2 has a privilege inversion flaw in the GET /build/logs/:jobId endpoint. The SSE stream registers an abort listener that calls cancelBuildOnDisconnect() using the privileged BUILDER_API_KEY whenever a client disconnects, bypassing the normal build‑cancellation permission check. Read‑only API key holders can exploit this to cancel any running native build by simply opening and then disconnecting the log stream.

Cap‑go (Cap-go) is affected when operating with any version older than 12.128.2. The vulnerability impacts all installations that expose the SSE build log stream and use the default /build/logs/:jobId endpoint without custom access restrictions.

The CVSS score of 7.1 reflects medium‑to‑high risk, and the EPSS score is not available, but the flaw is not listed in CISA KEV. The attack can be carried out remotely by any user possessing a read‑only API key, which is typically a low‑privilege credential. An attacker would issue a GET request to /build/logs/:jobId, open the SSE stream, then close the connection to trigger an unauthorized build cancellation. Because the vulnerability bypasses the explicit POST /build/cancel/:jobId permission, it effectively lifts a narrow read‑only capability to the power to terminate builds. This can disrupt continuous integration pipelines, leading to availability problems and potential downstream failures.