Executive brief
Capgo, a platform for managing app updates and builds, contains a security flaw in its build upload service. An unauthorized person can send specific web requests that bypass security checks and force the server to crash or return errors. This can be used to flood the system with traffic, causing a service outage or making the platform unavailable to legitimate users.
Technical details
An authentication bypass exists in the Capgo API's build upload component due to missing authentication middleware for HTTP OPTIONS requests. Specifically, the '/build/upload/:jobId/*' route in 'supabase/functions/_backend/public/build/index.ts' explicitly handles OPTIONS requests by bypassing the 'middlewareKey' check and invoking 'tusProxy()' with a synthetic, empty API key object. Because the downstream logic expects a valid authentication context and job state, these requests consistently trigger a 500 Internal Server Error. A remote, unauthenticated attacker can exploit this to perform request flooding, log amplification, and application-layer denial of service (DoS). The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo API < 12.128.2
Timeline
- 2026-02-10: advisory: GitHub Security Advisory published
- 2026-06-21: disclosed: NVD publication date