Executive brief
Cap-go, a platform for managing mobile app updates, contained a security flaw in its build upload system. An unauthorized person could use a specific web request to determine if a build job ID exists, which could be used to gather information for more targeted attacks. Additionally, the flaw allowed attackers to send large amounts of traffic to the system, potentially slowing down services for legitimate users.
Technical details
An observable discrepancy vulnerability (CWE-203) exists in the Cap-go cloud API's handling of HTTP OPTIONS requests at the `/build/upload/:jobId/*` endpoint. The endpoint is reachable without an API key and returns different HTTP status codes (204 vs 404) depending on whether a provided `:jobId` is valid. This allows unauthenticated remote attackers to perform a 'job existence oracle' attack to enumerate valid build IDs. Furthermore, because the endpoint proxies requests to a TUS handler with non-trivial latency, it can be exploited for unauthenticated resource consumption (CWE-400). The issue is resolved in version 12.128.2 by implementing proper authentication middleware.
Affected products
- Cap-go capgo-cloud-api < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-06-21: disclosed: CVE published to NVD