CVE-2026-100622 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

EUVD-2026-87717

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

CVE-2026-100622 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

CVE-2026-100622 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

CVE-2026-100622

Versions of capgo.app through 12.129.0 are vulnerable to a flaw where the application fails to verify the deletion status of bundle artifacts when serving them from the public file read endpoint . This allows unauthenticated attackers to download deleted bundles using cached URLs. Furthermore, ca...

CVE-2026-100622: Exposure of Sensitive Information to an Unauthorized Actor

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

PT-2026-99293

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.129.0 Description The application fails to verify the deletion status when serving cached bundle artifacts from the public file read endpoint. This allows unauthenticated attackers to download bundles that have...

PT-2026-29598

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.78.0 Description The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. Recommendations...