CVE-2026-100625

Name of the Vulnerable Software and Affected Versions Capgo (capgo.app) (affected versions not specified)

Description A native build TUS upload proxy at the endpoint supabase/functions/ backend/public/build/upload.ts improperly handles authorization. The proxy validates the caller against a specific build job using the builder job id and checks the stored upload path, but it forwards a user-controlled TUS resource suffix from the path /build/upload/:jobId/* to the builder service while injecting a privileged builder API key. Since the forwarded suffix is not bound to the authorized job's upload path or upload session key, an attacker with a valid 'all' or 'write' Capgo API key and app.build native permission for one application can write to the TUS upload resource of a different job, provided the resource suffix is known, leading to the corruption of build artifacts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.