Cap-go before version 12.128.2 contains an information‑disclosure flaw in the OPTIONS /build/upload/:jobId/* endpoint that lets an unauthenticated user determine whether a specific builder job ID exists. By sending requests to this endpoint and observing differences in the responses, an attacker can systematically enumerate valid job identifiers. The direct impact is the exposure of job IDs, which may aid a more advanced attack or enable resource‑consumption attacks, but the vulnerability does not provide code execution or direct access to job contents.

The Cap‑go project, specifically the Cap‑go Capgo application prior to version 12.128.2, is affected. No other vendors or products are listed in the advisory.

The CVSS base score of 6.9 indicates a moderate severity. No EPSS data is available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is sending unauthenticated OPTIONS requests to the exposed endpoint, as the endpoint is publicly accessible and does not require authentication. This inference follows from the endpoint description and the fact that no credentials are mentioned. Because the probe can be repeated without restriction, an attacker could generate sustained traffic to exhaust resources or use the enumerated identifiers to target downstream components for more damaging attacks.