CVE-2026-100624 Details
Description
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.
A vulnerability exists in Capgo.app versions prior to 12.264.5, where the TUS proxy endpoint for build uploads does not properly enforce upload expiry or the build lifecycle state. When a native build request is initiated, an upload expiry timestamp (set for one hour later) and a 'pending' status are recorded. However, the upload proxy only retrieves a limited set of data and only verifies the app.build_native permission before allowing POST, PATCH, and HEAD requests to be forwarded to the internal builder. This oversight enables an authenticated user with the appropriate permission to continue uploading to the build session even after the expiry has lapsed or the build has progressed beyond the upload phase, unless the builder service itself rejects the request.
Users should update to Capgo.app version 12.264.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Oct 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-mqr8-g67p-jm26 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-mqr8-g67p-jm26 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-app-before-12.264.5-upload-expiry-bypass-via-build-upload | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo.app | < 12.264.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 5, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |