Vulnerability in Cap-Go Capgo.app
CVE-2026-100624
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (18.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.000
Affected products
Weakness classification (CWE)
References
- GitHub Security Advisory (GHSA-mqr8-g67p-jm26) (vendor-advisory)
- VulnCheck Advisory: Capgo.app before 12.264.5 Upload Expiry Bypass via build upload (third-party-advisory)
Frequently asked questions
- What is CVE-2026-100624?
- CVE-2026-100624 is a medium-severity vulnerability in Cap-Go Capgo.app, classified under Insufficient Session Expiration. CVSS score: 5.4/10. Published 2026-09-26.
- How severe is CVE-2026-100624?
- Medium severity. CVSS v3 base score is 5.4 out of 10.