Unrated severityNVD Advisory· Published Jun 21, 2026
Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint
CVE-2026-56299
Description
Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<12.128.2+ 1 more
- (no CPE)range: <12.128.2
- (no CPE)range: <12.128.2
Patches
Vulnerability mechanics
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-6c7m-4223-446jmitrevendor-advisory
- www.vulncheck.com/advisories/capgo-denial-of-service-via-unauthenticated-options-request-to-build-upload-endpointmitrethird-party-advisory
News mentions
0No linked articles in our index yet.