Executive brief
Capgo's native build service exposes a file upload proxy that incorrectly validates user permissions. An attacker with a valid API key and permission to create builds for one application can use a legitimate upload request for their build job to corrupt another user's build artifacts by manipulating the upload path. This could result in deployment of tampered application builds or denial of service.
Technical details
The TUS upload proxy in supabase/functions/_backend/public/build/upload.ts authorizes a caller against a specific build job (jobId) and checks the upload_path shape, but fails to bind the user-supplied TUS resource suffix to that authenticated job's upload_session_key or upload_path. An attacker with a valid Capgo API key holding app.build_native permission can craft a request using their authorized job A's proxy path while injecting a known TUS resource suffix from job B, causing the service to forward the write operation with Capgo's privileged builder API key to an unintended build. No patch was available at advisory publication.
Affected products
- Capgo capgo.app all versions
Timeline
- 2026-09-26: disclosed
- 2026-09-08: advisory