Executive brief
Capgo, a platform for managing mobile app updates and builds, contained a security flaw that allowed users to interfere with other customers' build processes. By exploiting this vulnerability, an authenticated user could cancel or restart build jobs belonging to different organizations if they knew the specific job ID. This could lead to service disruptions, sabotage of development workflows, and unexpected billing charges for the victim.
Technical details
A Broken Object Level Authorization (BOLA) vulnerability exists in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints of Capgo. The application validates permissions based on an attacker-supplied 'app_id' in the request body but fails to verify if the 'jobId' specified in the URL path actually belongs to that application or the user's organization. An attacker with 'app.build_native' permissions for their own application can manipulate the 'jobId' to issue privileged commands to the backend builder service using the server's internal API key. This allows for cross-tenant build sabotage and unauthorized compute resource consumption. The issue is resolved in version 12.128.2 by implementing server-side validation of the job ownership before processing builder commands.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-03: advisory: Vendor advisory published on GitHub
- 2026-06-24: disclosed: CVE published and NVD record created