Quick answers
- Is CVE-2026-100622 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-100622 being exploited in the wild.
- How severe is CVE-2026-100622?
- High severity, with a CVSS score of 7.5, published 26 September 2026.
- Which products and versions are affected?
- Cap-go Capgo.App through 12.129.0.
- Is there a fix for CVE-2026-100622?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-100622 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-100622?
- Check whether you run Cap-go Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The public bundle read endpoint lacks deletion status verification before serving cached responses; it only checks that the parent app exists. When a cache hit occurs and the object is missing from R2 storage, the endpoint performs a best-effort restore by writing cached bytes back to storage. An unauthenticated attacker with a cached URL can retrieve deleted bundles indefinitely until the cache expires, and the first post-deletion cache hit will resurrect the deleted object into storage via an unprotected bucket.put() operation.
Affected products
- Cap-go capgo.app through 12.129.0
Timeline
- 2026-09-26: disclosed: Public advisory published