EUVD-2026-38172
GHSA-844f-662p-whq4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated OPTIONS endpoint leaks job IDs (C:L); no integrity or availability impact warrants N scoring for both.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.
AnalysisAI
Unauthenticated job ID enumeration in Cap-go (Capgo) before version 12.128.2 exposes internal builder job identifiers via observable response discrepancies on the OPTIONS /build/upload/:jobId/* endpoint. Any network-accessible attacker can probe this endpoint without credentials to distinguish valid job IDs from invalid ones, effectively building a map of active build jobs. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the zero-barrier exploitation (no auth, no interaction) and dual impact of information disclosure and incidental resource consumption make it a meaningful exposure for organizations running self-hosted Capgo instances.
Technical ContextAI
Capgo (CPE: cpe:2.3:a:cap-go:capgo:*:*:*:*:*:*:*:*) is an open-source over-the-air update platform for Capacitor mobile apps. The vulnerability is classified as CWE-203 (Observable Discrepancy), a class of side-channel flaw where differing server responses to valid versus invalid inputs leak internal state. Specifically, the HTTP OPTIONS preflight endpoint at /build/upload/:jobId/* returns distinguishably different responses depending on whether the probed jobId corresponds to a real builder job. Because OPTIONS is a CORS preflight method often excluded from authentication middleware, it is particularly susceptible to being left unprotected. Affected versions span all Capgo releases prior to 12.128.2 per EUVD-2026-38172 and the GitHub Security Advisory GHSA-9c2x-7h5x-37gm.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which contains the vendor-released patch per the GitHub Security Advisory GHSA-9c2x-7h5x-37gm (https://github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gm). As a compensating control prior to patching, operators can place an API gateway or reverse proxy in front of Capgo and reject or require authentication for all OPTIONS requests to the /build/upload/ path hierarchy - note this may break legitimate CORS preflight flows if browser-based clients access the upload endpoint, so validate against your application's CORS requirements before deploying. Rate-limiting unauthenticated OPTIONS requests at the network perimeter can also reduce the enumeration throughput and incidental resource consumption without breaking functionality. VulnCheck's advisory (https://www.vulncheck.com/advisories/cap-go-job-existence-oracle-via-unauthenticated-options-build-upload-jobid) provides additional remediation context.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today