Authorization Bypass in Capgo TUS Upload Proxy

CVE-2026-100625

What is CVE-2026-100625?

Capgo's TUS upload proxy system features a flaw where it fails to properly bind user-controlled upload resource suffixes to authorized job paths. The vulnerability occurs within the proxy that validates access based only on the builder_job_id, while still exposing a path for an attacker with valid API keys to manipulate resources across different build jobs. This may allow unauthorized modifications to build artifacts, potentially corrupting them. This issue affects all versions of the product and has no available patch at this time.

References