CVE-2026-100624: Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp (one hour) and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid, ownerorg, builderjobid, and uploadpath and checks only the app.buildnative permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.buildnative permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgo.appto a version that resolves this vulnerability.Fixed in 12.264.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated caller with the app.build_native permission for the affected app can exploit it. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What conditions make an installation vulnerable?
Versions before 12.264.5 are affected when the /build/upload/:jobId TUS proxy accepts requests for a build upload session after its recorded expiry or after the build has left the upload phase. Exploitation may be prevented if the separate builder service independently rejects the request.
What should be done if updating is not immediately possible?
Restrict app.build_native permission to only trusted users and service accounts, since that permission is required to continue writing to the upload session. Review access to build-upload operations and rely on builder-side validation where available.
How can administrators identify potentially affected build uploads?
Check for POST, PATCH, or HEAD requests to /build/upload/:jobId associated with build requests whose upload_expires_at time had passed or whose status was no longer pending. Such requests indicate that the proxy may have forwarded access outside the intended upload window.