Executive brief
Capgo.app is a mobile build and deployment platform that manages native application builds. The upload proxy for build artifacts fails to enforce expiration timestamps and build lifecycle state checks, allowing authenticated developers to continue uploading data after their upload window should have closed or after the build process has already moved past the upload phase. This could allow unauthorized modification or injection of build artifacts.
Technical details
The /build/upload/:jobId TUS proxy endpoint loads only app_id, owner_org, builder_job_id, and upload_path from the build_requests table, omitting upload_expires_at and status checks before forwarding POST, PATCH, and HEAD requests to the internal builder. An authenticated caller with app.build_native permission can exploit this by sending upload requests after the one-hour upload window expires or after the build transitions to non-pending states (e.g., completed). The vulnerability requires valid API credentials and the appropriate build permission but lacks any time or state validation.
Affected products
- Capgo capgo.app before 12.264.5
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: fixed in version 12.264.5