Unauthenticated Cache Bypass in Capgo.app Artifacts

Executive Summary

CVE-2026-100622 is a vulnerability in capgo.app through version 12.129.0 where deleted bundle artifacts can be served from an edge cache and restored into storage. The public file read endpoint fails to verify if a file is still active before serving cached responses. Unauthenticated attackers can download deleted bundles using cached URLs, triggering restoration of deleted objects into R2 storage on cache hits.

The issue occurs because the system serves cached responses before checking storage. On cache hits, it attempts to restore cached bytes back into storage if the object is missing, effectively undoing deletions. This allows unauthorized access to sensitive information via old URLs while the cache entry exists.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to cached URLs of deleted bundles by monitoring edge cache logs for repeated requests to the same artifact URLs after deletion. Look for cache hits that trigger R2 storage restorations. Verify if any deleted bundles are unexpectedly restored by checking storage logs for recreated objects.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can access deleted bundles containing sensitive data by using cached URLs. This could lead to exposure of confidential information, such as application data or user content, that was intended to be permanently removed. The vulnerability may also allow attackers to restore deleted objects into storage, bypassing intended deletion and retention policies.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing sensitive information to unauthorized parties. GDPR requires proper data deletion and protection measures, while HIPAA mandates safeguards for protected health information. The inability to permanently delete data due to cache restoration may result in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to the latest version of capgo.app beyond 12.129.0. Implement validation checks to ensure requested files are active artifacts before serving cached responses. Remove automatic cache-to-R2 restoration for non-active paths. Monitor and clear edge cache entries for deleted bundles.

Useful 0 Not Useful 0