CVE-2026-100624

Name of the Vulnerable Software and Affected Versions Capgo.app versions prior to 12.264.5

Description The '/build/upload/:jobId' TUS proxy endpoint fails to enforce upload expiry or build lifecycle state. While native build requests include an upload expires at timestamp and a 'pending' status, the upload proxy only verifies the app.build native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. Consequently, an authenticated user with the app.build native permission can continue writing to a build upload session after the expiry time has passed or after the build has progressed beyond the upload phase, provided the internal builder service does not independently reject the request.

Recommendations Update to version 12.264.5.