Vulnerability in Cap-Go Capgo.app
CVE-2026-100624
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.
Published .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/Cap-go/capgo.app/security/advisories/GHSA-mqr8-g67p-jm26 (vendor-advisory)
- www.vulncheck.com/advisories/capgo-app-before-12.264.5-upload-expiry-bypass-via… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-100624?
- CVE-2026-100624 is a medium-severity vulnerability in Cap-Go Capgo.app, classified under Insufficient Session Expiration. CVSS score: 5.4/10. Published 2026-09-26.
- How severe is CVE-2026-100624?
- Medium severity. CVSS v3 base score is 5.4 out of 10.