EUVD-2026-38738Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv tenant user (PR:L) hits network endpoint with no UI; cross-tenant impact crosses authorization scope (S:C); availability High from build cancellation, C/I Low.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder commands with the server-held builder API key. An authenticated user with the app.build_native permission for any app they control can start or cancel arbitrary builder jobs belonging to other tenants by supplying a victim jobId, resulting in cross-tenant build sabotage (denial of service), unauthorized compute actions, and potential billing impact.
AnalysisAI
Cross-tenant build sabotage in Capgo before 12.128.2 allows authenticated users with the app.build_native permission to start or cancel arbitrary builder jobs belonging to other tenants by supplying a victim jobId to the /build/start/:jobId and /build/cancel/:jobId endpoints. The handlers trust the attacker-supplied app_id in the request body and never verify jobId ownership, enabling denial of service, unauthorized compute consumption, and billing impact across tenants. No public exploit identified at time of analysis.
Technical ContextAI
Capgo is a live-update and native build service for Capacitor mobile applications, operating as a multi-tenant SaaS where customers submit builds processed by a backend builder using a server-held builder API key. The flaw is a textbook CWE-285 / BOLA (broken object level authorization) issue in the REST handlers for POST /build/start/:jobId and POST /build/cancel/:jobId: the controllers consult only the app_id field from the JSON body - which the requester fully controls - to determine authorization, while the actual privileged operation is keyed on the :jobId path parameter. Because no join is performed between jobId and the caller's tenant/org, an attacker can pair a legitimate app_id they own with any jobId in the global namespace and have the trusted server-side identity issue the builder command on their behalf.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds tenant/ownership verification linking the :jobId path parameter to the caller's app_id and organization before issuing builder commands; consult the GHSA advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-72j4-9qp5-hfrg for fix details. For self-hosted deployments that cannot upgrade immediately, restrict network access to the /build/start/:jobId and /build/cancel/:jobId endpoints to trusted internal callers via a reverse-proxy ACL or temporarily revoke the app.build_native permission from non-essential users, accepting that legitimate builds initiated by those users will fail until access is restored. Monitoring builder logs for requests where the jobId's recorded owning org does not match the requesting user's org is a useful detection control while patching is rolled out.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today