What is GHSA-33r3-cpxm-4xg2?

GHSA-33r3-cpxm-4xg2 is a security advisory published by GitHub Security Advisories with Medium severity. Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId...

Which CVE IDs does GHSA-33r3-cpxm-4xg2 cover?

GHSA-33r3-cpxm-4xg2 covers the following CVE IDs: CVE-2026-56299. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-33r3-cpxm-4xg2?

GHSA-33r3-cpxm-4xg2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-33r3-cpxm-4xg2MediumCVSS 5.3

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId...

Vendor

GitHub Security Advisories

Published

June 21, 2026

Last Modified

June 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-56299 →

📋 Description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.

🔗 References (4)

https://github.com/Cap-go/capgo/security/advisories/GHSA-6c7m-4223-446j
https://nvd.nist.gov/vuln/detail/CVE-2026-56299
https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unauthenticated-options-request-to-build-upload-endpoint
https://github.com/advisories/GHSA-33r3-cpxm-4xg2