Vulnerability · Published Jun 21, 2026 · Assigned by VulnCheck

CVE-2026-56299Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint

Medium 5.3

In plain English

A medium-severity missing authentication in Capgo from Capgo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GHSA Advisory GHSA-6c7m-4223-446j vendor-advisory
VulnCheck Advisory: Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint third-party-advisory