CVE-2026-100625

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is never bound to the authorized job's upload_path or upload_session_key, a caller holding a valid 'all' or 'write' Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at the time of advisory publication.

• CWE-441

• https://github.com/Cap-go/capgo.app/security/advisories/GHSA-r45q-x4gr-3mvv
• https://www.vulncheck.com/advisories/capgo-build-upload-proxy-authorization-bypass-via-tus-resource

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10062A vulnerability was determined in TRENDnet TEW-432BRP 3.10B2…9.8
• CVE-2026-100620Capgo CLI (npm package @capgo/cli) through 7.98.2 is affecte…3.8
• CVE-2026-100621Capgo (capgo.app) contains an incomplete access-control/cont…4.3
• CVE-2026-100622capgo.app through 12.129.0 fails to verify deletion status w…7.5
• CVE-2026-100623Capgo (capgo.app) exposes the legacy membership table public…8.8
• CVE-2026-100624Capgo.app before 12.264.5 does not enforce upload expiry or …5.4
• CVE-2026-100626capgo through 12.128.2 contains an insecure direct object re…4.3
• CVE-2026-100627Capgo (Cap-go/capgo.app) server backend Supabase functions c…8.1
• CVE-2026-100628capgo.app before 12.128.12 fails to enforce an organization'…4.3
• CVE-2026-100629Capgo (capgo.app backend) before 12.127.5 contains an author…5.5
• CVE-2026-10063A vulnerability was identified in TRENDnet TEW-432BRP 3.10B2…9.8
• CVE-2026-100630AVideo contains a stored cross-site scripting vulnerability …5.4