CVE-2026-100625

CVE

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

September 27, 2026

Last Seen

September 27, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Capgo Build Upload Proxy Vulnerability CVE-2026-100625 Disclosed58.5

Capgo (capgo.app) has a critical vulnerability (CVE-2026-100625) in its TUS upload proxy, allowing unauthorized access to build artifacts. The flaw arises from the proxy's inadequate validation of user-controlled resource suffixes, enabling attackers with valid API keys to manipulate uploads across...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Capgo Build Upload Proxy Vulnerability CVE-2026-100625 Disclosed

2h ago·3 sources

Related Articles (3)

Capgo Build Upload Proxy Authorization Bypass via TUS ResourceCapgo (capgo.ap... CVE: New / 1d Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder...

cve.threatint.com·2h ago

CVE-2026-100625 CVE Vulnerability Disclosures / 1d Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffi

cve.report·2h ago

CVE-2026-100625 - Exploits & Severity

Feedly·16h ago

Related Entities

Capgo CVE-2026-100706 Supabase