https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:52:41 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-100625 <p>Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job&#39;s stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo&#39;s privileged builder API key. Because the forwarded suffix is never bound to the authorized job&#39;s upload_path or upload_session_key, a caller holding a valid &#39;all&#39; or &#39;write&#39; Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build&#39;s artifacts. All versions are affected; no patch was available at the time of advisory publication.</p> <p>Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job&#39;s stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo&#39;s privileged builder API key. Because the forwarded suffix is never bound to the authorized job&#39;s upload_path or upload_session_key, a caller holding a valid &#39;all&#39; or &#39;write&#39; Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build&#39;s artifacts. All versions are affected; no patch was available at the time of advisory publication.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-100625 https://vulnerability.circl.lu/vuln/ghsa-vp2f-59w8-7r7r <p>Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job&#39;s stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo&#39;s privileged builder API key. Because the forwarded suffix is never bound to the authorized job&#39;s upload_path or upload_session_key, a caller holding a valid &#39;all&#39; or &#39;write&#39; Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build&#39;s artifacts. All versions are affected; no patch was available at the time of advisory publication.</p> <p>Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job&#39;s stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo&#39;s privileged builder API key. Because the forwarded suffix is never bound to the authorized job&#39;s upload_path or upload_session_key, a caller holding a valid &#39;all&#39; or &#39;write&#39; Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build&#39;s artifacts. All versions are affected; no patch was available at the time of advisory publication.</p> https://vulnerability.circl.lu/vuln/ghsa-vp2f-59w8-7r7r