CVE-2026-100625: Capgo Build Upload Proxy Authorization Bypass via TUS Resource
Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/ to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is never bound to the authorized job's uploadpath or uploadsessionkey, a caller holding a valid 'all' or 'write' Capgo API key with app.buildnative permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at the time of advisory publication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid Capgo API key with either the 'all' or 'write' scope and the app.build_native permission for at least one application. They must also know or obtain the TUS resource suffix for a different build job they intend to target.
Are default deployments affected?
All versions are affected. The vulnerable behavior is in the native build TUS upload proxy, so deployments using that proxy are exposed when a suitably privileged API key and a target TUS resource suffix are available.
What can an attacker do after exploiting it?
The attacker can use an upload path authorized for one build job to write to the TUS upload resource for another job. This can corrupt the targeted build's artifacts; the stated impact includes integrity loss and limited availability impact.
Is a patch available?
No patch was available at the time of advisory publication. The provided information does not identify a documented workaround.
How can I determine whether a build may have been targeted?
Review native build upload activity for requests where the authorized builder_job_id does not correspond to the TUS resource suffix forwarded to the builder service. The issue occurs when a proxy request authorized for one job is used to access another job's TUS resource.