CVE-2026-56229: Capgo Build Logs Authorization Bypass – API Scope Escape

Technical summary

The vulnerability exists in the /build/status and /build/logs endpoints of Capgo prior to version 12.128.2. The authorization control fails to properly validate that the supplied app_id and job_id belong to the same logical scope when processing requests from restricted API keys. An attacker can provide an app_id associated with an authorized credential alongside a job_id from an unauthorized application, bypassing the intended scope restrictions. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), indicating improper validation of API key scope boundaries.

Business impact

This vulnerability directly threatens CI/CD pipeline confidentiality. Build logs and metadata often contain environment variables, deployment secrets, API tokens, database connection strings, and source code patterns. Competitors or malicious actors with limited API access could harvest sensitive operational information, intellectual property, and credentials from competitor or partner applications running on the same Capgo instance. This is particularly dangerous in multi-tenant environments where API key segmentation is the primary trust boundary.

Affected systems

Capgo versions prior to 12.128.2 are affected. This includes all earlier minor and patch versions. Users operating self-hosted or managed Capgo instances with multiple applications and restricted API keys are at highest risk, particularly in shared CI/CD environments or when Capgo is used across multiple teams or customers.

Exploitability

Exploiting this vulnerability requires valid API credentials (CWE-639 vector: PR:L indicates low privilege requirement). An attacker must already possess an API key, but scope bypass is trivial once authenticated—no sophisticated techniques, timing attacks, or race conditions are required. The attack is repeatable and leaves minimal forensic trace in most logging configurations. Network access and manual effort are minimal; automated scanning could identify target job_ids through observable build endpoints or information disclosure.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch enforces proper scope validation, ensuring API keys can only access build resources belonging to authorized applications. Organizations should verify the upgrade in a non-production environment before deploying, and should audit API key permissions and recent build log access patterns to confirm no unauthorized access occurred during the window the system was vulnerable.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. Verify against the Capgo release notes and vendor advisory for any additional remediation steps or configuration changes. Test the patch in a staging environment that mirrors your production API key setup, particularly if you use restricted keys across multiple applications. Monitor application logs after patching to confirm normal build operations resume without authorization errors.

Detection guidance

Review Capgo API logs (if retained) for requests to /build/status or /build/logs endpoints from a single API credential accessing job_ids from multiple distinct applications. Look for patterns where app_id and job_id do not naturally correspond (e.g., app_id 'ProjectA' paired with job_id patterns belonging to 'ProjectB'). Monitor for API key usage patterns that deviate from expected application assignments. Implement or enhance API audit logging to capture request parameters and response times before upgrading, as forensic evidence may help identify what data was accessed.

Why prioritize this

While the CVSS score of 6.5 (Medium) reflects that authenticated access is required, the practical risk is elevated because: (1) build logs are high-value targets containing secrets and intellectual property, (2) the vulnerability is trivial to exploit for any attacker with a single API key, (3) in multi-tenant or multi-application scenarios, API key scope is a fundamental trust boundary, and (4) credential exposure in build logs can cascade into infrastructure compromise. Organizations relying on Capgo for CI/CD orchestration should prioritize this patch within their standard update cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity assessment: network-accessible endpoints (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N). The score appropriately captures that an authenticated user can obtain sensitive information, but does not reflect multi-tenant risk amplification or the typical high sensitivity of build artifacts in practice.

Frequently asked questions