Is CVE-2026-100625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100625 being exploited in the wild.

How severe is CVE-2026-100625?

High severity, with a CVSS score of 7.1, published 26 September 2026.

Is there a fix for CVE-2026-100625?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100625 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100625?

Check whether you run Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100625: Capgo build upload proxy authorization bypass via TUS resource

CVE-2026-100625 · Severity: high · CVSS 7.1 · Published 2026-09-26

Capgo's native build service exposes a file upload proxy that incorrectly validates user permissions. An attacker with a valid API key and permission to create builds for one application can use a legitimate upload request for their build job to corrupt another user's build artifacts by manipulating the upload path. This could result in deployment of tampered application builds or denial of service.

Technologies: Capgo.App. Vendors: Capgo.

Quick answers

Is CVE-2026-100625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100625 being exploited in the wild.
How severe is CVE-2026-100625?: High severity, with a CVSS score of 7.1, published 26 September 2026.
Which products and versions are affected?: Capgo.App all versions.
Is there a fix for CVE-2026-100625?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100625 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100625?: Check whether you run Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The TUS upload proxy in supabase/functions/_backend/public/build/upload.ts authorizes a caller against a specific build job (jobId) and checks the upload_path shape, but fails to bind the user-supplied TUS resource suffix to that authenticated job's upload_session_key or upload_path. An attacker with a valid Capgo API key holding app.build_native permission can craft a request using their authorized job A's proxy path while injecting a known TUS resource suffix from job B, causing the service to forward the write operation with Capgo's privileged builder API key to an unintended build. No patch was available at advisory publication.

Affected products

Capgo capgo.app all versions

Timeline

2026-09-26: disclosed
2026-09-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.