Medium
Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
Type: advisorySources: OSV
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-100624
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 07:17 UTC · Revision 1
Source evidence
Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
core-osv · Original sourcePublished 26 Sept 2026, 13:23 UTC
Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.
osv:CVE-2026-100624
Complete source record
{
"id": "06948bc744ea71d5f4a6dd566cb08b734988ab672a45ace96c5d9fc376bb2ab4",
"url": "https://osv.dev/vulnerability/CVE-2026-100624",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Capgo.app before 12.264.5 Upload Expiry Bypass via build upload",
"summary": "Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder. As a result, an authenticated caller holding app.build_native permission for the app can continue writing to the build upload session after the stored expiry has passed or after the build has moved beyond the upload phase, unless the separate builder service independently rejects the request. The issue is fixed in 12.264.5.",
"evidence": "osv:CVE-2026-100624",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-100624",
"aliases": [
"CVE-2026-100624",
"GHSA-mqr8-g67p-jm26"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cap-go/capgo.app",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2289c089d65cdaa054dc73c3479341678115c358"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "12.264.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "12.264.5"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"capgo-12.264.4",
"capgo-12.264.3",
"cli-8.45.2",
"capgo-12.264.2",
"cli-8.45.1",
"capgo-12.264.1",
"capgo-12.264.0",
"cli-8.45.0",
"capgo-12.263.0",
"capgo-12.262.3",
"cli-8.44.0",
"capgo-12.262.2",
"capgo-12.262.1",
"cli-8.43.2",
"capgo-12.262.0",
"capgo-12.261.1",
"cli-8.43.1",
"capgo-12.261.0",
"capgo-12.260.1",
"capgo-12.260.0",
"capgo-12.259.0",
"cli-8.43.0",
"capgo-12.258.0",
"capgo-12.257.2",
"capgo-12.257.1",
"cli-8.42.5",
"cli-8.42.4",
"cli-8.42.3",
"capgo-12.257.0",
"capgo-12.256.3",
"capgo-12.256.2",
"capgo-12.256.1",
"cli-8.42.2",
"cli-8.42.1",
"capgo-12.256.0",
"capgo-12.255.1",
"capgo-12.255.0",
"capgo-12.254.1",
"capgo-12.254.0",
"capgo-12.253.3",
"capgo-12.253.2",
"capgo-12.253.1",
"cli-8.41.5",
"cli-8.41.4",
"capgo-12.253.0",
"capgo-12.252.0",
"capgo-12.251.0",
"cli-8.41.3",
"cli-8.41.2",
"cli-8.41.1",
"cli-8.41.0",
"cli-8.40.0",
"cli-8.39.2",
"capgo-12.250.0",
"capgo-12.249.0",
"capgo-12.248.3",
"capgo-12.248.2",
"cli-8.39.1",
"capgo-12.248.1",
"capgo-12.248.0",
"capgo-12.247.0",
"capgo-12.246.1",
"capgo-12.246.0",
"cli-8.39.0",
"capgo-12.245.0",
"cli-8.38.0",
"cli-8.37.4",
"capgo-12.244.4",
"cli-8.37.3",
"capgo-12.244.3",
"capgo-12.244.2",
"capgo-12.244.1",
"capgo-12.244.0",
"capgo-12.243.0",
"capgo-12.242.5",
"capgo-12.242.4",
"capgo-12.242.3",
"capgo-12.242.2",
"capgo-12.242.1",
"capgo-12.242.0",
"capgo-12.241.0",
"capgo-12.240.4",
"capgo-12.240.3",
"capgo-12.240.2",
"cli-8.37.2",
"capgo-12.240.1",
"capgo-12.240.0",
"cli-8.37.1",
"capgo-12.239.4",
"capgo-12.239.3",
"capgo-12.239.2",
"capgo-12.239.1",
"capgo-12.239.0",
"capgo-12.238.0",
"capgo-12.237.0",
"capgo-12.236.0",
"cli-8.37.0",
"capgo-12.235.0",
"capgo-12.234.0",
"capgo-12.233.1",
"capgo-12.233.0",
"cli-8.36.0",
"capgo-12.232.0",
"cli-8.35.0",
"capgo-12.231.0",
"capgo-12.230.0",
"capgo-12.229.1",
"capgo-12.229.0",
"cli-8.34.0",
"capgo-12.228.0",
"capgo-12.227.2",
"capgo-12.227.1",
"capgo-12.227.0",
"capgo-12.226.0",
"cli-8.33.5",
"capgo-12.225.2",
"capgo-12.225.1",
"capgo-12.225.0",
"capgo-12.224.1",
"cli-8.33.4",
"capgo-12.224.0",
"cli-8.33.3",
"capgo-12.223.4",
"capgo-12.223.3",
"capgo-12.223.2",
"capgo-12.223.1",
"capgo-12.223.0",
"capgo-12.222.0",
"capgo-12.221.0",
"capgo-12.220.2",
"capgo-12.220.1",
"cli-8.33.2",
"capgo-12.220.0",
"capgo-12.219.0",
"capgo-12.218.1",
"capgo-12.218.0",
"capgo-12.217.9",
"capgo-12.217.8",
"capgo-12.217.7",
"capgo-12.217.6",
"capgo-12.217.5",
"capgo-12.217.4",
"capgo-12.217.3",
"capgo-12.217.2",
"capgo-12.217.1",
"capgo-12.217.0",
"capgo-12.216.1",
"capgo-12.216.0",
"capgo-12.215.1",
"capgo-12.215.0",
"capgo-12.214.1",
"capgo-12.214.0",
"capgo-12.213.0",
"capgo-12.212.0",
"capgo-12.211.0",
"cli-8.33.1",
"capgo-12.210.6",
"capgo-12.210.5",
"capgo-12.210.4",
"capgo-12.210.3",
"capgo-12.210.2",
"capgo-12.210.1",
"capgo-12.210.0",
"cli-8.33.0",
"capgo-12.209.13",
"cli-8.32.8",
"capgo-12.209.12",
"capgo-12.209.11",
"capgo-12.209.10",
"cli-8.32.7",
"capgo-12.209.9",
"cli-8.32.6",
"capgo-12.209.8",
"capgo-12.209.7",
"cli-8.32.5",
"capgo-12.209.6",
"cli-8.32.4",
"capgo-12.209.5",
"capgo-12.209.4",
"capgo-12.209.3",
"capgo-12.209.2",
"capgo-12.209.1",
"capgo-12.209.0",
"cli-8.32.2",
"capgo-12.208.1",
"cli-8.32.3",
"capgo-12.208.0",
"capgo-12.207.2",
"cli-8.32.1",
"cli-8.32.0",
"cli-8.31.7",
"cli-8.31.6",
"capgo-12.207.1",
"capgo-12.207.0",
"cli-8.31.5",
"cli-8.31.4",
"capgo-12.206.13",
"capgo-12.206.12",
"capgo-12.206.11",
"capgo-12.206.10",
"capgo-12.206.9",
"capgo-12.206.8",
"capgo-12.206.7",
"capgo-12.206.6",
"capgo-12.206.5",
"capgo-12.206.4",
"capgo-12.206.3",
"cli-8.31.3",
"capgo-12.206.2",
"cli-8.31.2",
"capgo-12.206.1",
"capgo-12.206.0",
"capgo-12.205.0",
"capgo-12.204.8",
"capgo-12.204.7",
"capgo-12.204.6",
"capgo-12.204.5",
"capgo-12.204.4",
"capgo-12.204.3",
"capgo-12.204.2",
"cli-8.31.1",
"capgo-12.204.1",
"cli-8.31.0",
"capgo-12.204.0",
"capgo-12.203.5",
"capgo-12.203.4",
"capgo-12.203.3",
"capgo-12.203.2",
"capgo-12.203.1",
"cli-8.30.0",
"capgo-12.203.0",
"cli-8.29.3",
"capgo-12.202.1",
"capgo-12.202.0",
"capgo-12.201.7",
"capgo-12.201.6",
"cli-8.29.2",
"capgo-12.201.5",
"capgo-12.201.4",
"cli-8.29.1",
"capgo-12.201.3",
"capgo-12.201.2",
"capgo-12.201.1",
"capgo-12.201.0",
"cli-8.29.0",
"capgo-12.200.0",
"capgo-12.199.6",
"cli-8.28.2",
"capgo-12.199.5",
"capgo-12.199.4",
"capgo-12.199.3",
"capgo-12.199.2",
"capgo-12.199.1",
"capgo-12.199.0",
"capgo-12.198.6",
"capgo-12.198.5",
"capgo-12.198.4",
"capgo-12.198.3",
"capgo-12.198.2",
"capgo-12.198.1",
"capgo-12.198.0",
"capgo-12.197.3",
"capgo-12.197.2",
"notifications-0.1.13",
"cli-8.28.1",
"capgo-12.197.1",
"cli-8.28.0",
"capgo-12.197.0",
"cli-8.27.0",
"capgo-12.196.0",
"cli-8.26.0",
"capgo-12.195.0",
"capgo-12.194.2",
"notifications-0.1.12",
"cli-8.25.13",
"capgo-12.194.1",
"capgo-12.194.0",
"notifications-0.1.11",
"cli-8.25.12",
"capgo-12.193.5",
"capgo-12.193.4",
"notifications-0.1.10",
"cli-8.25.11",
"capgo-12.193.3",
"capgo-12.193.2",
"notifications-0.1.9",
"cli-8.25.10",
"capgo-12.193.1",
"notifications-0.1.8",
"cli-8.25.9",
"capgo-12.193.0",
"capgo-12.192.0",
"gh-attach-assets",
"notifications-0.1.7",
"cli-8.25.8",
"capgo-12.191.1",
"notifications-0.1.6",
"cli-8.25.7",
"capgo-12.191.0",
"notifications-0.1.5",
"cli-8.25.6",
"capgo-12.190.2",
"capgo-12.190.1",
"cli-8.25.5",
"capgo-12.190.0",
"notifications-0.1.4",
"capgo-12.189.1",
"notifications-0.1.3",
"cli-8.25.4",
"capgo-12.189.0",
"capgo-12.188.5",
"notifications-0.1.2",
"cli-8.25.3",
"capgo-12.188.4",
"cli-8.25.2",
"capgo-12.188.3",
"notifications-0.1.1",
"cli-8.25.1",
"capgo-12.188.2",
"capgo-12.188.1",
"notifications-0.1.0",
"cli-8.25.0",
"capgo-12.188.0",
"cli-8.24.6",
"capgo-12.187.4",
"capgo-12.187.3",
"cli-8.24.5",
"capgo-12.186.1",
"capgo-12.187.2",
"cli-8.24.4",
"capgo-12.187.1",
"capgo-12.187.0",
"cli-8.24.3",
"capgo-12.186.14",
"cli-8.24.2",
"capgo-12.186.13",
"capgo-12.186.12",
"cli-8.24.1",
"capgo-12.186.11",
"capgo-12.186.10",
"cli-8.24.0",
"capgo-12.186.9",
"cli-8.23.4",
"capgo-12.186.8",
"capgo-12.186.7",
"cli-8.23.3",
"capgo-12.186.6",
"capgo-12.186.5",
"cli-8.23.2",
"capgo-12.186.4",
"capgo-12.186.3",
"cli-8.23.1",
"cli-8.23.0",
"cli-8.22.1",
"capgo-12.186.2",
"cli-8.22.0",
"capgo-12.186.0",
"cli-8.21.1",
"cli-8.21.0",
"cli-8.20.2",
"capgo-12.185.2",
"capgo-12.185.1",
"cli-8.20.1",
"capgo-12.185.0",
"capgo-12.184.2",
"cli-8.20.0",
"cli-8.19.0",
"capgo-12.184.1",
"cli-8.18.0",
"capgo-12.184.0",
"cli-8.17.4",
"cli-8.17.3",
"capgo-12.183.0",
"cli-8.17.2",
"capgo-12.182.1",
"capgo-12.182.0",
"cli-8.17.1",
"capgo-12.181.0",
"cli-8.17.0",
"cli-8.16.0",
"cli-8.15.0",
"capgo-12.180.0",
"cli-8.14.1",
"cli-8.14.0",
"cli-8.13.0",
"capgo-12.179.0",
"cli-8.12.6",
"capgo-12.178.4",
"cli-8.12.5",
"capgo-12.178.3",
"cli-8.12.4",
"capgo-12.178.2",
"capgo-12.178.1",
"capgo-12.177.1",
"cli-8.12.2",
"capgo-12.177.0",
"capgo-12.176.3",
"cli-8.12.1",
"capgo-12.176.1",
"capgo-12.176.2",
"cli-8.12.0",
"capgo-12.176.0",
"cli-8.11.1",
"capgo-12.175.1",
"cli-8.11.0",
"capgo-12.175.0",
"capgo-12.174.1",
"cli-8.10.0",
"capgo-12.174.0",
"cli-8.9.2",
"capgo-12.173.2",
"cli-8.9.1",
"capgo-12.173.1",
"capgo-12.173.0",
"cli-8.9.0",
"capgo-12.172.2",
"capgo-12.172.1",
"cli-8.8.2",
"capgo-12.172.0",
"capgo-12.171.2",
"cli-8.8.0",
"capgo-12.171.0",
"cli-8.7.3",
"capgo-12.170.0",
"cli-8.7.2",
"capgo-12.169.0",
"capgo-12.168.0",
"cli-8.7.1",
"capgo-12.167.2",
"capgo-12.167.1",
"cli-8.7.0",
"capgo-12.167.0",
"cli-8.6.0",
"cli-8.5.3",
"capgo-12.166.2",
"capgo-12.166.1",
"cli-8.5.2",
"cli-8.5.1",
"cli-8.5.0",
"capgo-12.166.0",
"cli-8.4.1",
"cli-8.4.0",
"capgo-12.165.0",
"cli-8.3.1",
"capgo-12.164.1",
"cli-8.3.0",
"capgo-12.164.0",
"cli-8.2.1",
"capgo-12.163.0",
"capgo-12.162.11",
"cli-8.2.0",
"cli-8.1.10",
"capgo-12.162.10",
"capgo-12.162.9",
"cli-8.1.9",
"capgo-12.162.8",
"capgo-12.162.7",
"cli-8.1.8",
"capgo-12.162.6",
"capgo-12.162.5",
"cli-8.1.7",
"capgo-12.162.4",
"cli-8.1.6",
"capgo-12.162.3",
"capgo-12.162.2",
"cli-8.1.5",
"capgo-12.162.1",
"cli-8.1.4",
"capgo-12.162.0",
"capgo-12.161.5",
"cli-8.1.3",
"capgo-12.161.4",
"cli-8.1.2",
"capgo-12.161.3",
"capgo-12.161.2",
"cli-8.1.1",
"capgo-12.161.1",
"capgo-12.161.0",
"cli-8.0.8",
"cli-8.0.5",
"capgo-12.160.13",
"capgo-12.160.12",
"cli-8.0.7",
"capgo-12.160.11",
"capgo-12.160.10",
"cli-8.0.6",
"capgo-12.160.9",
"capgo-12.160.8",
"capgo-12.160.7",
"cli-8.0.4",
"capgo-12.160.6",
"cli-8.0.0",
"capgo-13.0.0",
"capgo-12.160.0",
"cli-7.125.3",
"capgo-12.159.18",
"capgo-12.159.16",
"cli-7.125.1",
"capgo-12.159.15",
"capgo-12.159.14",
"cli-7.124.13",
"capgo-12.159.13",
"cli-7.124.12",
"capgo-12.159.11",
"cli-7.124.11",
"capgo-12.159.10",
"capgo-12.159.9",
"cli-7.124.10",
"capgo-12.159.8",
"capgo-12.159.7",
"cli-7.124.9",
"capgo-12.159.6",
"cli-7.121.0",
"capgo-12.159.2",
"cli-7.124.5",
"capgo-12.159.1",
"capgo-12.159.0",
"cli-7.124.4",
"capgo-12.158.2",
"cli-7.124.3",
"capgo-12.158.1",
"capgo-12.158.0",
"cli-7.124.2",
"capgo-12.157.4",
"capgo-12.157.3",
"cli-7.124.1",
"capgo-12.157.2",
"capgo-12.157.1",
"cli-7.124.0",
"capgo-12.157.0",
"cli-7.123.0",
"cli-7.122.7",
"capgo-12.156.6",
"capgo-12.156.5",
"cli-7.122.6",
"capgo-12.156.4",
"cli-7.122.4",
"capgo-12.156.3",
"capgo-12.156.2",
"cli-7.122.3",
"cli-7.122.2",
"capgo-12.156.1",
"cli-7.122.1",
"cli-7.122.0",
"capgo-12.156.0",
"cli-7.120.0",
"capgo-12.155.0",
"cli-7.119.2",
"capgo-12.154.2",
"capgo-12.154.1",
"cli-7.119.1",
"capgo-12.154.0",
"capgo-12.153.1",
"cli-7.119.0",
"cli-7.118.0",
"capgo-12.153.0",
"cli-7.117.2",
"capgo-12.152.1",
"capgo-12.152.0",
"cli-7.117.1",
"capgo-12.151.1",
"capgo-12.151.0",
"cli-7.117.0",
"cli-7.116.1",
"cli-7.116.0",
"capgo-12.150.0",
"cli-7.115.0",
"cli-7.114.1",
"capgo-12.149.1",
"cli-7.114.0",
"cli-7.113.0",
"capgo-12.149.0",
"capgo-12.148.10",
"cli-7.112.5",
"capgo-12.148.9",
"capgo-12.148.8",
"cli-7.112.4",
"capgo-12.148.7",
"capgo-12.148.6",
"cli-7.112.3",
"capgo-12.148.5",
"capgo-12.148.4",
"cli-7.112.2",
"capgo-12.148.3",
"capgo-12.148.2",
"cli-7.112.1",
"capgo-12.148.1",
"cli-7.112.0",
"capgo-12.148.0",
"cli-7.111.7",
"capgo-12.147.2",
"cli-7.111.6",
"capgo-12.147.1",
"cli-7.111.5",
"capgo-12.147.0",
"capgo-12.146.7",
"cli-7.111.4",
"capgo-12.146.6",
"cli-7.111.3",
"capgo-12.146.5",
"capgo-12.146.4",
"cli-7.111.2",
"capgo-12.146.3",
"cli-7.111.1",
"capgo-12.146.1",
"cli-7.111.0",
"capgo-12.146.0",
"cli-7.110.0",
"cli-7.109.4",
"capgo-12.145.5",
"capgo-12.145.4",
"cli-7.109.3",
"capgo-12.145.3",
"cli-7.109.2",
"capgo-12.145.2",
"capgo-12.145.1",
"cli-7.109.1",
"capgo-12.145.0",
"capgo-12.144.1",
"cli-7.109.0",
"capgo-12.144.0",
"cli-7.108.4",
"capgo-12.143.3",
"cli-7.108.3",
"cli-7.108.2",
"cli-7.108.1",
"capgo-12.143.2",
"capgo-12.143.1",
"cli-7.108.0",
"capgo-12.143.0",
"capgo-12.142.1",
"cli-7.107.0",
"capgo-12.142.0",
"cli-7.106.0",
"capgo-12.141.0",
"cli-7.105.2",
"capgo-12.140.3",
"cli-7.105.1",
"capgo-12.140.2",
"cli-7.105.0",
"capgo-12.140.1",
"cli-7.104.0",
"capgo-12.140.0",
"cli-7.103.0",
"capgo-12.139.1",
"capgo-12.139.0",
"cli-7.102.0",
"cli-7.101.0",
"capgo-12.138.4",
"cli-7.100.8",
"capgo-12.138.3",
"cli-7.100.7",
"capgo-12.138.2",
"capgo-12.138.1",
"cli-7.100.6",
"capgo-12.138.0",
"cli-7.100.5",
"capgo-12.137.11",
"capgo-12.137.8",
"cli-7.100.3",
"capgo-12.137.7",
"cli-7.100.2",
"capgo-12.137.6",
"capgo-12.137.5",
"cli-7.100.1",
"capgo-12.137.4",
"cli-7.100.0",
"capgo-12.137.3",
"capgo-12.137.2",
"cli-7.99.3",
"capgo-12.137.1",
"cli-7.99.2",
"capgo-12.137.0",
"capgo-12.136.10",
"cli-7.99.1",
"capgo-12.136.9",
"cli-7.99.0",
"capgo-12.136.8",
"capgo-12.136.7",
"cli-7.98.2",
"capgo-12.136.6",
"cli-7.98.0",
"capgo-12.136.3",
"cli-7.97.5",
"capgo-12.136.2",
"cli-7.97.4",
"capgo-12.136.1",
"capgo-12.136.0",
"cli-7.97.3",
"capgo-12.135.3",
"capgo-12.135.2",
"cli-7.97.2",
"capgo-12.135.1",
"capgo-12.135.0",
"cli-7.97.0",
"cli-7.97.1",
"capgo-12.134.1",
"capgo-12.134.0",
"capgo-12.133.0",
"capgo-12.132.1",
"cli-7.96.1",
"capgo-12.132.0",
"capgo-12.131.1",
"cli-7.96.0",
"capgo-12.131.0",
"capgo-12.130.6",
"cli-7.95.17",
"capgo-12.130.5",
"cli-7.95.16",
"capgo-12.130.4",
"capgo-12.130.3",
"capgo-12.130.2",
"capgo-12.130.1",
"capgo-12.130.0",
"capgo-12.129.0",
"cli-7.95.15",
"cli-7.95.14",
"capgo-12.128.13",
"cli-7.95.13",
"capgo-12.128.12",
"capgo-12.128.11",
"capgo-12.128.10",
"capgo-12.128.9",
"capgo-12.128.8",
"capgo-12.128.7",
"cli-7.95.12",
"capgo-12.128.6",
"cli-7.95.11",
"capgo-12.128.5",
"capgo-12.128.4",
"capgo-12.128.3",
"capgo-12.128.2",
"capgo-12.128.1",
"capgo-12.128.0",
"capgo-12.127.23",
"capgo-12.127.22",
"cli-7.95.10",
"capgo-12.127.21",
"capgo-12.127.20",
"capgo-12.127.19",
"capgo-12.127.18",
"capgo-12.127.17",
"cli-7.95.9",
"capgo-12.127.16",
"capgo-12.127.15",
"capgo-12.127.14",
"cli-7.95.8",
"capgo-12.127.13",
"capgo-12.127.12",
"cli-7.95.7",
"capgo-12.127.11",
"capgo-12.127.10",
"capgo-12.127.9",
"cli-7.95.6",
"capgo-12.127.8",
"capgo-12.127.5",
"cli-7.95.5",
"capgo-12.127.4",
"cli-7.95.4",
"capgo-12.127.3",
"capgo-12.127.2",
"cli-7.95.3",
"capgo-12.127.1",
"cli-7.95.2",
"capgo-12.127.0",
"cli-7.95.1",
"capgo-12.126.2",
"capgo-12.126.1",
"cli-7.95.0",
"capgo-12.126.0",
"capgo-12.125.0",
"cli-7.94.9",
"capgo-12.124.9",
"capgo-12.124.7",
"cli-7.94.8",
"cli-7.94.7",
"capgo-12.124.6",
"capgo-12.124.5",
"cli-7.94.6",
"capgo-12.124.4",
"cli-7.94.5",
"capgo-12.124.3",
"capgo-12.124.1",
"capgo-12.124.0",
"capgo-12.123.9",
"cli-7.94.1",
"cli-7.94.0",
"v12.123.8",
"v12.123.7",
"v12.123.6",
"v12.123.5",
"v12.123.4",
"v12.123.3",
"v12.123.2",
"v12.123.1",
"v12.123.0",
"v12.122.16",
"v12.122.15",
"v12.122.14",
"v12.122.13",
"v12.122.12",
"v12.122.11",
"v12.122.10",
"v12.122.9",
"v12.122.8",
"v12.122.7",
"v12.122.6",
"v12.122.5",
"v12.122.4",
"v12.122.3",
"v12.122.2",
"v12.122.1",
"v12.122.0",
"v12.121.11",
"v12.121.10",
"v12.121.9",
"v12.121.8",
"v12.121.7",
"v12.121.6",
"v12.121.5",
"v12.121.4",
"v12.121.2",
"v12.121.1",
"v12.121.0",
"v12.120.20",
"v12.120.19",
"v12.120.16",
"v12.120.15",
"v12.120.14",
"v12.120.13",
"v12.120.12",
"v12.120.11",
"v12.120.10",
"v12.120.9",
"v12.120.8",
"v12.120.7",
"v12.120.6",
"v12.120.5",
"v12.120.4",
"v12.119.21",
"v12.119.20",
"v12.119.19",
"v12.119.18",
"v12.119.17",
"v12.119.16",
"v12.119.15",
"v12.119.14",
"v12.119.13",
"v12.119.12",
"v12.119.10",
"v12.119.9",
"v12.119.8",
"v12.119.6",
"v12.119.5",
"v12.119.4",
"v12.119.3",
"v12.119.0",
"v12.118.2",
"v12.118.1",
"v12.118.0",
"v12.117.8",
"v12.117.6",
"v12.117.5",
"v12.117.4",
"v12.117.3",
"v12.117.2",
"v12.117.1",
"v12.116.72",
"v12.116.71",
"v12.116.70",
"v12.116.69",
"v12.116.68",
"v12.116.67",
"v12.116.66",
"v12.116.65",
"v12.116.64",
"v12.116.63",
"v12.116.62",
"v12.116.61",
"v12.116.60",
"v12.116.59",
"v12.116.58",
"v12.116.57",
"v12.116.56",
"v12.116.55",
"v12.116.54",
"v12.116.53",
"v12.116.52",
"v12.116.51",
"v12.116.50",
"v12.116.49",
"v12.116.48",
"v12.116.47",
"v12.116.46",
"v12.116.45",
"v12.116.41",
"v12.116.40",
"v12.116.39",
"v12.116.34",
"v12.116.33",
"v12.116.30",
"v12.116.29",
"v12.116.28",
"v12.116.27",
"v12.116.24",
"v12.116.23",
"v12.116.22",
"v12.116.21",
"v12.116.20",
"v12.116.19",
"v12.116.18",
"v12.116.17",
"v12.116.16",
"v12.116.15",
"v12.116.14",
"v12.116.13",
"v12.116.12",
"v12.116.11",
"v12.116.10",
"v12.116.9",
"v12.116.8",
"v12.116.7",
"v12.116.6",
"v12.116.5",
"v12.116.4",
"v12.116.3",
"v12.116.2",
"v12.116.1",
"v12.116.0",
"v12.115.2",
"v12.115.0",
"v12.114.12",
"v12.114.9",
"v12.114.7",
"v12.114.6",
"v12.114.4",
"v12.114.2",
"v12.114.1",
"v12.114.0",
"v12.113.2",
"v12.113.1",
"v12.113.0",
"v12.112.6",
"v12.112.5",
"v12.112.4",
"v12.112.3",
"v12.112.2",
"v12.112.1",
"v12.112.0",
"v12.111.3",
"v12.111.2",
"v12.111.1",
"v12.110.6",
"v12.110.5",
"v12.110.4",
"v12.110.3",
"v12.110.2",
"v12.110.0",
"v12.109.17",
"v12.109.15",
"v12.109.14",
"v12.109.13",
"v12.109.12",
"v12.109.11",
"v12.109.10",
"v12.109.9",
"v12.109.8",
"v12.109.7",
"v12.109.6",
"v12.109.5",
"v12.109.4",
"v12.109.3",
"v12.109.2",
"v12.109.1",
"v12.109.0",
"v12.108.19",
"v12.108.18",
"v12.108.17",
"v12.108.16",
"v12.108.15",
"v12.108.14",
"v12.108.13",
"v12.108.12",
"v12.108.11",
"v12.108.10",
"v12.108.9",
"v12.108.8",
"v12.108.7",
"v12.108.6",
"v12.108.5",
"v12.108.4",
"v12.108.3",
"v12.108.2",
"v12.108.1",
"v12.108.0",
"v12.107.26",
"v12.107.24",
"v12.107.22",
"v12.107.21",
"v12.107.20",
"v12.107.19",
"v12.107.11",
"v12.107.10",
"v12.107.8",
"v12.107.7",
"v12.107.6",
"v12.107.5",
"v12.107.4",
"v12.107.3",
"v12.107.2",
"v12.107.1",
"v12.107.0",
"v12.106.2",
"v12.106.1",
"v12.106.0",
"v12.105.9",
"v12.105.8",
"v12.105.6",
"v12.105.5",
"v12.105.4",
"v12.105.3",
"v12.105.0",
"v12.104.3",
"v12.104.2",
"v12.103.1",
"v12.102.6",
"v12.102.4",
"v12.102.3",
"v12.102.2",
"v12.102.1",
"v12.102.0",
"v12.101.1",
"v12.101.0",
"v12.100.15",
"v12.100.14",
"v12.100.13",
"v12.100.12",
"v12.100.11",
"v12.100.10",
"v12.100.9",
"v12.100.8",
"v12.100.7",
"v12.100.6",
"v12.100.5",
"v12.100.4",
"v12.100.3",
"v12.100.1",
"v12.100.0",
"v12.99.1",
"v12.99.0",
"v12.98.3",
"v12.98.2",
"v12.98.1",
"v12.97.1",
"v12.97.0",
"v12.96.2",
"v12.96.1",
"v12.96.0",
"v12.95.0",
"v12.94.6",
"v12.94.2",
"v12.94.1",
"v12.94.0",
"v12.93.6",
"v12.93.5",
"v12.93.4",
"v12.93.3",
"v12.93.2",
"v12.93.1",
"v12.93.0",
"v12.92.0",
"v12.91.15",
"v12.91.14",
"v12.91.12",
"v12.91.10",
"v12.91.9",
"v12.91.8",
"v12.91.7",
"v12.91.6",
"v12.91.5",
"v12.91.4",
"v12.91.3",
"v12.91.2",
"v12.91.1",
"v12.91.0",
"v12.90.3",
"v12.90.2",
"v12.90.1",
"v12.90.0",
"v12.89.17",
"v12.89.16",
"v12.89.15",
"v12.89.14",
"v12.89.12",
"v12.89.9",
"v12.89.6",
"v12.89.5",
"v12.87.1",
"v12.86.2",
"v12.86.0",
"v12.85.9",
"v12.85.8",
"v12.85.7",
"v12.85.4",
"v12.85.3",
"v12.85.2",
"v12.85.1",
"v12.85.0",
"v12.84.6",
"v12.84.5",
"v12.73.2",
"v12.56.26",
"v12.56.25",
"v12.56.24",
"v12.56.18",
"v12.56.16",
"v12.56.15",
"v12.56.14",
"v12.56.13",
"v12.56.12",
"v12.56.11",
"v12.56.10",
"v12.56.9",
"v12.56.8",
"v12.56.7",
"v12.56.6",
"v12.56.4",
"v12.56.2",
"v12.56.1",
"v12.56.0",
"v12.55.9",
"v12.55.8",
"v12.55.5",
"v12.55.4",
"v12.55.3",
"10.0.0",
"1.66.4",
"1.64.1",
"1.62.4",
"1.62.1",
"1.62.0",
"1.61.35",
"1.61.34",
"1.61.33",
"1.61.27",
"1.61.23",
"1.61.21",
"1.61.17",
"1.61.15",
"1.61.14",
"1.61.12",
"1.61.2",
"1.60.4",
"1.58.16",
"1.58.15",
"1.58.1",
"1.55.44",
"1.55.43",
"1.55.42",
"1.55.39",
"1.55.38",
"1.55.37",
"1.55.35",
"1.55.31",
"1.55.23",
"1.55.12",
"1.55.9",
"1.55.6",
"1.55.5",
"1.55.4",
"1.55.3",
"1.55.2",
"1.55.0",
"1.54.9",
"1.54.6",
"1.54.5",
"1.54.4",
"1.54.3",
"1.54.2",
"1.54.1",
"1.54.0",
"1.53.8",
"1.53.7",
"1.53.6",
"1.53.5",
"1.53.4",
"1.53.3",
"1.53.2",
"1.53.1",
"1.53.0",
"1.52.3",
"1.52.2",
"1.52.1",
"1.51.0",
"1.50.3",
"1.50.2",
"1.50.1",
"1.50.0",
"1.48.1",
"1.48.0",
"1.47.3",
"1.47.1",
"1.47.0",
"1.46.4",
"1.46.0",
"1.45.4",
"1.45.3",
"1.45.2",
"1.45.1",
"1.45.0",
"1.44.26",
"1.44.21",
"1.44.19",
"1.44.16",
"1.44.15",
"1.44.12",
"1.44.11",
"1.44.1",
"1.43.1",
"1.39.0",
"1.37.31",
"1.37.22",
"1.37.15",
"1.37.5",
"1.36.49",
"1.36.41",
"1.36.25",
"1.36.24",
"1.36.22",
"1.36.15",
"1.36.12",
"1.36.8",
"1.36.7",
"1.36.4",
"1.35.1",
"1.35.0",
"1.34.0",
"1.33.3",
"1.31.4",
"1.31.3",
"1.31.1",
"1.28.3",
"1.27.6",
"1.27.3",
"1.27.2",
"1.27.1",
"1.27.0",
"1.26.2",
"1.26.1",
"1.25.14",
"1.25.7",
"1.25.6",
"1.25.2",
"1.24.18",
"1.24.17",
"1.24.16",
"1.24.10",
"1.24.3",
"1.24.2",
"1.24.1",
"1.24.0",
"1.23.1",
"1.23.0",
"1.22.2",
"1.22.1",
"1.21.25",
"1.21.23",
"1.21.19",
"1.21.11",
"1.21.10",
"1.21.9",
"1.21.8",
"1.21.7",
"1.21.6",
"1.21.0",
"1.20.3",
"1.20.2",
"1.20.1",
"1.20.0",
"1.19.5",
"1.19.4",
"1.19.3",
"1.18.36",
"1.18.33",
"1.18.28",
"1.18.26",
"1.18.24",
"1.18.16",
"1.18.10",
"1.18.9",
"1.18.8",
"1.18.5",
"1.18.4",
"1.18.2",
"1.18.1",
"1.18.0",
"1.17.0",
"1.17.0-alpha.1",
"1.17.0-alpha.0",
"1.16.3-alpha.0",
"1.16.1-alpha.0",
"1.16.0-alpha.0",
"1.14.6",
"1.14.4",
"1.13.13",
"1.13.12",
"1.13.11",
"1.13.5",
"1.13.4",
"1.13.3",
"1.12.1",
"1.11.1",
"1.11.0",
"1.10.2",
"1.10.1",
"1.10.0",
"1.9.10",
"1.9.9",
"1.9.7",
"1.9.6",
"1.9.1",
"1.9.0-alpha.0",
"1.8.7-alpha.2",
"1.8.7-alpha.1",
"1.8.7-alpha.0",
"1.8.6",
"1.8.3",
"1.8.1",
"1.7.28",
"1.7.27",
"1.7.24",
"1.7.15",
"1.7.10",
"1.6.11",
"1.6.7",
"0.30.19",
"0.30.12",
"0.30.12-alpha.1",
"0.30.9-alpha.16",
"0.30.9-alpha.15",
"0.30.9-alpha.10",
"0.30.9-alpha.9",
"0.30.9-alpha.6",
"0.30.9-alpha.3",
"0.30.9-alpha.0",
"0.30.8-alpha.4",
"0.30.8-alpha.1",
"0.30.8-alpha.0",
"0.30.6-alpha.2",
"0.30.6-alpha.0",
"0.30.5-alpha.4",
"0.30.2",
"0.29.5",
"0.29.1",
"0.26.1",
"0.26.0",
"0.24.1",
"0.23.0",
"0.20.2",
"0.20.1",
"0.19.0",
"0.18.2",
"0.16.3",
"0.16.1",
"0.16.0",
"0.15.1",
"0.14.6",
"0.14.5",
"0.14.2",
"0.14.0",
"0.11.0",
"0.6.1",
"0.3.1",
"0.1.8",
"0.1.6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100624.json"
}
}
],
"modified": "2026-10-28T02:30:26.667811751Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100624.json",
"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-mqr8-g67p-jm26",
"https://nvd.nist.gov/vuln/detail/CVE-2026-100624",
"https://www.vulncheck.com/advisories/capgo-app-before-12.264.5-upload-expiry-bypass-via-build-upload"
],
"provider_metadata": {
"cwe_ids": [
"CWE-613"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100624.json"
}
},
"related_cves": [
{
"value": "CVE-2026-100624",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493337,
"published_at": "2026-09-26T13:23:02.328+00:00"
}