{"id":29705,"date":"2026-09-27T00:31:31","date_gmt":"2026-09-26T16:31:31","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100625"},"modified":"2026-09-27T00:31:31","modified_gmt":"2026-09-26T16:31:31","slug":"cve-2026-100625","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100625","title":{"rendered":"CVE-2026-100625 [HIGH] &#8211; Capgo (capgo.app) exposes a native build TUS upload proxy (supabase\/functions\/_backend\/pub"},"content":{"rendered":"<p>Capgo (capgo.app) exposes a native build TUS upload proxy (supabase\/functions\/_backend\/public\/build\/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job&#8217;s stored upload_path, but then forwards the user-controlled TUS resource suffix taken from \/build\/upload\/:jobId\/* to the builder service while injecting Capgo&#8217;s privileged builder API key. Because the forwarded suffix is never bound to the authorized job&#8217;s upload_path or upload_session_key, a caller holding a valid &#8216;all&#8217; or &#8216;write&#8217; Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build&#8217;s artifacts. All versions are affected; no patch was available at the time of advisory publication.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Capgo (capgo.app) exposes a native build TUS upload proxy (supabase\/functions\/_backend\/public\/build\/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_jo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29705","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}