CVE-2026-56231 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-56231

CVSS 7.6 · High EPSS 0,31%

Kerentanan Improper Authorization. Skor CVSS 3.1 7.6 (High) menurut vulncheck.com.

Deskripsi (NVD)

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder commands with the server-held builder API key. An authenticated user with the app.build_native permission for any app they control can start or cancel arbitrary builder jobs belonging to other tenants by supplying a victim jobId, resulting in cross-tenant build sabotage (denial of service), unauthorized compute actions, and potential billing impact.

Rincian

Terbit di NVD: 24 Juni 2026
Terakhir diubah: 25 Juni 2026
Status NVD: Deferred
CVSS 3.1: 7.6 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-285: Improper Authorization
EPSS (30 hari): 0,31% peluang dieksploitasi; lebih tinggi dari 21,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.