EUVD-2026-87720

Capgo capgo.app exposes a native build TUS upload proxy supabase/functions/backend/public/build/upload.ts that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource...

CVE-2026-100625

The Capgo (capgo.app) platform is vulnerable to an authorization bypass in its native build TUS upload proxy located at supabase/functions/_backend/public/build/upload.ts. The root cause is that the proxy validates a caller against a specific builder_job_id but fails to bind the forwarded user-co...

CVE-2026-100625: Unintended Proxy or Intermediary

Capgo capgo.app exposes a native build TUS upload proxy supabase/functions/backend/public/build/upload.ts that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource...