CVE-2026-100624
Received Received - Intake

Capgo.app Build Upload Session Bypass

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100624
EUVD
EUVD-2026-87719

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo.app to 12.264.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100624 is a vulnerability in Capgo.app before version 12.264.5 where the build upload proxy fails to enforce upload expiry or build lifecycle state checks. The proxy forwards upload requests to the internal builder without validating the upload_expires_at timestamp or build status, allowing authenticated users with app.build_native permission to continue uploading files even after the upload window has expired or the build has moved beyond the upload phase.

This creates a time-of-check time-of-use (TOCTOU) race condition where the proxy checks permissions but not the upload expiry or lifecycle state before forwarding requests.

Detection Guidance

Check Capgo.app version with: curl -s https://your-capgo-instance.com/api/version | grep version. If version is below 12.264.5, the system is vulnerable. Review build_requests table for expired upload_expires_at timestamps or invalid lifecycle states. Monitor TUS proxy logs for POST/PATCH/HEAD requests to /build/upload/:jobId after expiry or lifecycle changes.

Impact Analysis

This vulnerability could allow attackers to reuse old or invalid upload endpoints, potentially leading to build artifact corruption, session reuse, or denial of service. Attackers with app.build_native permission could upload files beyond the intended timeframe or after the build lifecycle has progressed, compromising the integrity of the build process.

Mitigation Strategies

Upgrade Capgo.app to version 12.264.5 or later immediately. Ensure the upload proxy enforces upload_expires_at and build lifecycle state checks before forwarding requests. Review and revoke unnecessary app.build_native permissions. Monitor build upload sessions for suspicious activity after expiry.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart