CVE-2026-100625— Capgo Build Upload Proxy Authorization Bypass via TUS Resource
Quick assessment
Affected
Cap-go capgo.app
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Capgo（capgo.app）暴露了一个原生构建任务的 TUS 上传代理接口（位于 supabase/functions/_backend/public/build/upload.ts）。该接口仅通过提供的 builder_job_id 对调用者进行单个构建任务的授权验证，并检查该任务所存储的 upload_path，但在后续步骤中，会将用户可控的、从 /build/upload/:jobId/* 路径中提取的 TUS 资源后缀直接转发给构建服务，并同时注入 Capgo 的特权构建 API 密钥。 由于转发的资源
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100625
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Capgo Build Upload Proxy Authorization Bypass via TUS Resource
Source: CVE Program / CVE List V5
Vulnerability Description
Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is never bound to the authorized job's upload_path or upload_session_key, a caller holding a valid 'all' or 'write' Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at the time of advisory publication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未有动机的代理或中间人(混淆代理)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100625
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100625
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100625 (1)
Other References for CVE-2026-100625 (1)
Same Patch Batch · Cap-go · 2026-09-26 · 19 CVEs total
| CVE-2026-100619 | 8.8 HIGH | Capgo OTA Manifest Poisoning via app_versions.manifest Bypass |
| CVE-2026-100614 | 8.8 HIGH | Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker |
| CVE-2026-100623 | 8.8 HIGH | Capgo Authentication Bypass via Direct PostgREST org_users Table Write |
| CVE-2026-100617 | 8.8 HIGH | Cap-go capgo.app Authorization Bypass via channel_permission_overrides |
| CVE-2026-100615 | 8.8 HIGH | Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation |
| CVE-2026-100618 | 8.5 HIGH | Capgo App Icon Update Privilege Escalation via Service-Role Worker |
| CVE-2026-100627 | 8.1 HIGH | Capgo bundle promotion API channel RBAC deny override bypass |
| CVE-2026-100622 | 7.5 HIGH | capgo.app through 12.129.0 Cache Restoration of Deleted Bundles |
| CVE-2026-100612 | 7.2 HIGH | Capgo SSO Provider ID Authentication Bypass via Incomplete Migration |
| CVE-2026-100611 | 6.5 MEDIUM | Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list |
| CVE-2026-100629 | 5.5 MEDIUM | Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH |
| CVE-2026-100616 | 5.5 MEDIUM | capgo.app Authentication Bypass via PostgREST customer_id Mutation |
| CVE-2026-100624 | 5.4 MEDIUM | Capgo.app before 12.264.5 Upload Expiry Bypass via build upload |
| CVE-2026-100613 | 5.3 MEDIUM | capgo.app Authorization Bypass via Stale Channel Permission Overrides |
| CVE-2026-100626 | 4.3 MEDIUM | capgo through 12.128.2 IDOR via PUT /app icon endpoint |
| CVE-2026-100628 | 4.3 MEDIUM | capgo.app before 12.128.12 Authentication Bypass via apikey |
| CVE-2026-100621 | 4.3 MEDIUM | capgo.app Content-Lock Bypass via r2-direct Bundle Mutation |
| CVE-2026-100620 | 3.8 LOW | Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service A |
IV. Related Vulnerabilities
Same product: capgo.app
-
CVE-2026-100626
capgo through 12.128.2 IDOR via PUT /app icon endpoint -
CVE-2026-100629
Capgo backend before 12.127.5 Privilege Escalation via role_ -
CVE-2026-100628
capgo.app before 12.128.12 Authentication Bypass via apikey -
CVE-2026-100627
Capgo bundle promotion API channel RBAC deny override bypass -
CVE-2026-100624
Capgo.app before 12.264.5 Upload Expiry Bypass via build upl
Same vendor: Cap-go
-
CVE-2026-100626
capgo through 12.128.2 IDOR via PUT /app icon endpoint -
CVE-2026-100629
Capgo backend before 12.127.5 Privilege Escalation via role_ -
CVE-2026-100628
capgo.app before 12.128.12 Authentication Bypass via apikey -
CVE-2026-100627
Capgo bundle promotion API channel RBAC deny override bypass -
CVE-2026-100624
Capgo.app before 12.264.5 Upload Expiry Bypass via build upl
Same weakness: CWE-441
-
CVE-2026-72668
Unintended Proxy or Intermediary ('Confused Deputy') in Kiba -
CVE-2026-100706
kyverno before 1.19.1 Privilege Escalation via Policy apiCal -
CVE-2026-75886
Openshift/console: openshift/console: unauthenticated revers -
CVE-2026-69399
Azure Arc Elevation of Privilege Vulnerability -
CVE-2026-50022
Metacat acts as unintended proxy to backend Apache SOLR engi
V. Comments for CVE-2026-100625
No comments yet