8 matches found
CVE-2026-100624
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
EUVD-2026-87719
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
CVE-2026-100624 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
CVE-2026-100624 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
CVE-2026-100624 Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
CVE-2026-100624: Insufficient Session Expiration
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...
CVE-2026-56299
CVE-2026-56299 (Capgo) affects Capgo prior to 12.128.2. An authentication bypass in the /build/upload/:jobId/* endpoint allows unauthenticated remote attackers to trigger repeated 500 errors by sending OPTIONS requests, bypassing authentication middleware and invoking tusProxy logic with invalid ...
CVE-2026-56299 Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint
Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/ endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid...