CVE-2026-56299 — Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint
Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 erro…
Published: 2026-06-21 · CVSS: 6.9 · CVSS 4.0
Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7