CVE-2026-56299

Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint

Published Jun 21, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.

Analysis

Technical impact

Capgo versions released before 12.128.2 contain an authentication bypass that allows attackers to send HTTP OPTIONS requests to the /build/upload/:jobId/* endpoint. The bypass forces the tusProxy logic to process requests with invalid credentials and consistently return 500 errors. Repeating this behavior can exhaust server resources, making the application unavailable to legitimate users. This weakness corresponds to CWE-306, an authentication bypass issue.

Affected Systems

The vulnerability affects Capgo applications that are earlier than version 12.128.2, regardless of deployment environment or hosting provider.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is unavailable, suggesting uncertainty about the exploitation likelihood. Because the bypass is triggered by unauthenticated OPTIONS requests, an attacker needs only remote network access and the ability to send HTTP traffic. The vulnerability is not listed in CISA’s KEV catalog, but its remote and unauthenticated nature makes it attractive for opportunistic denial‑of‑service attacks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Capgo

unaffected

Version	Status	Constraints
`0`	affected	< 12.128.2
`12.128.2`	unaffected	—

No data.

Vendor Product Versions

Cap-go

Version	Status	Scheme	Platform
`[0,12.128.2)`	affected	generic	—
`12.128.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Capgo to version 12.128.2 or later to receive the official fix.
Configure perimeter defenses such as a WAF or firewall to block unauthenticated OPTIONS requests to the /build/upload endpoint.
Implement monitoring of HTTP error rates and OPTIONS traffic to detect and mitigate potential denial‑of‑service attempts.

Generated by OpenCVE AI on June 21, 2026 at 18:05 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.683% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/Cap-go/capgo/security/advisories/GHSA-6c7m-4223-446j
https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unauthenticated-options-request-to-build-upload-endpoint

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cap-go Cap-go cap-go
Vendors & Products		Cap-go Cap-go cap-go

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 21, 2026 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.
Title		Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint
Weaknesses		CWE-306
References		https://github.com/Cap-go/capgo/security/advisories/GHSA-6c7m-4223-446j https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unauthenticated-options-request-to-build-upload-endpoint
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`