PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56299 Capgo CVE debrief

CVE-2026-56299 is a medium-severity authentication bypass vulnerability in Capgo before 12.128.2. The issue allows unauthenticated attackers to send OPTIONS requests to the /build/upload/:jobId/* endpoint, bypassing authentication middleware and invoking tusProxy logic with invalid credentials. This enables trivial request flooding and denial of service (DoS) attacks. The vulnerability has a CVSS score of 6.9 and was published on June 21, 2026.

Vendor
Capgo
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-21
Original CVE updated
2026-06-23
Advisory published
2026-06-21
Advisory updated
2026-06-23

Who should care

Organizations using Capgo versions before 12.128.2 should prioritize patching this vulnerability to prevent potential DoS attacks. Security teams and administrators responsible for Capgo deployments should review the official advisories and implement the recommended fixes.

Technical summary

The vulnerability exists in the /build/upload/:jobId/* endpoint of Capgo, where an unauthenticated attacker can send an OPTIONS request to bypass authentication middleware. This allows the attacker to invoke tusProxy logic with invalid credentials, leading to consistent 500 errors and potential DoS conditions. The issue is classified under CWE-306 and has a CVSS vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority due to potential for DoS attacks with CVSS score of 6.9

Recommended defensive actions

  • Inventory Capgo deployments to identify affected versions
  • Review official advisories for patching guidance
  • Implement vendor-supported remediation
  • Review compensating controls for unauthenticated requests
  • Monitor for suspicious OPTIONS requests
  • Track exceptions for /build/upload/:jobId/* endpoint usage

Evidence notes

The primary evidence for this vulnerability comes from the NVD and CVE.org records. The vulnerability affects Capgo versions before 12.128.2. The CVE record and NVD detail provide the basis for this debrief. Defenders should verify the official CVE record and NVD detail for the most up-to-date information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56299 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56299

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56299 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56299

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.