Upload Expiry Bypass Vulnerability in Capgo.app by Capgo
CVE-2026-100624

5.3MEDIUM

Key Information:

Vendor

Cap-go

Status
Capgo.app
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100624?

Capgo.app versions before 12.264.5 are vulnerable to an upload expiry bypass due to insufficient enforcement of upload expiry or build lifecycle state on the /build/upload/:jobId TUS proxy endpoint. An authenticated user with app.build_native permission can continue uploading files even after the initial upload expiration period of one hour has lapsed or once the build has exceeded its upload phase, leading to potential unauthorized access or misuse of the build system. This vulnerability has been addressed in the version 12.264.5 update.

Affected Version(s)

capgo.app 0 < 12.264.5

capgo.app 12.264.5

References

https://github.com/Cap-go/capgo.app/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/capgo-app-before-12....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Judel777
.