CVE-2026-100622

Executive Summary

CVE-2026-100622 is an information disclosure vulnerability in Capgo (capgo.app) through version 12.129.0, where the public file read endpoint fails to verify whether a requested bundle artifact has been marked as deleted. Unauthenticated remote attackers who possess or can reconstruct cached bundle URLs may retrieve deleted bundle contents and, on cache hits, cause previously deleted objects to be restored into R2 storage. The flaw is rated CVSS 3.1 base score 7.5 (HIGH), with high confidentiality impact and no public exploit or patch currently available.

Technical Analysis

Capgo is a distribution platform for over-the-air (OTA) updates for Capacitor-based mobile applications. Client applications and build pipelines retrieve bundle artifacts (JavaScript bundles, assets, and related payloads) from a public file read endpoint that serves content backed by an object storage layer (Cloudflare R2, per the NVD description).

The vulnerability is an access-control / lifecycle-state validation failure. When a bundle object is deleted from the platform's data model, the deletion is not enforced at the serving layer of the public file read endpoint. The endpoint validates only that a request maps to a cached artifact — it does not verify the current deletion status of that artifact before returning bytes to the caller. This is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Two distinct failure modes are described:

1. Stale read exposure: An unauthenticated requester who knows or retains a previously valid URL — for example, one captured from network traffic, mobile client logs, CDN references, or application source — can continue to download the deleted bundle artifact through the public endpoint.

2. Object restoration on cache hit: When the request results in a cache hit, the serving path triggers restoration of the deleted object back into R2 storage. This converts a read-only disclosure into a persistent state mutation: the deleted artifact re-materializes in the storage backend, extending its exposure window and defeating deletion as a data-removal control.

The attack surface is network-reachable and requires no authentication, no user interaction, and no special privileges (AV:N/AC:L/PR:N/UI:N). Complexity is low because the mechanism is a missing state check rather than a memory-safety or race-dependent condition. Confidentiality impact is rated High (C:H) because bundle contents can include proprietary client-side code, embedded configuration, and assets that the publisher intended to be unrecoverable; integrity and availability impacts are rated None in the CVSS vector.

No public PoC, exploit code, or Nuclei template has been observed, and no vendor patch evidence is available from tracked sources. Version 12.129.0 is the last known affected release.

Exploitation Scenarios

No public PoC is available for CVE-2026-100622; the chain below is inferred from the vulnerability class (missing deletion-status check on a public read endpoint) and the NVD description. No specific internal function names, API paths, or parameters are asserted, as the advisory does not disclose them.

1. Reconnaissance / target identification. The attacker identifies a Capgo deployment serving OTA bundles through the public file read endpoint. Candidate URLs can be collected from publicly available mobile application packages, client-side source maps, developer forum posts, CDN logs, or historical referrers. Because the endpoint is public and unauthenticated, no credential acquisition phase is required.

2. Triggering the flaw class. The attacker submits an HTTP GET for a bundle artifact URL that was valid at an earlier point in time — i.e., before the publisher deleted the bundle. The serving layer resolves the request against its cache but does not evaluate the artifact's current deletion status. This is the core defect: authorization-adjacent state validation is absent from the read path, not merely misconfigured.

3. Payload / execution method. Exploitation is a straightforward unauthenticated HTTP request. There is no injection payload, deserialization primitive, or authentication bypass to construct. Success is indicated by a 2xx response carrying bundle bytes rather than a "not found" or "gone" response for an artifact the publisher believes is deleted.

4. Post-exploitation impact. The attacker obtains the full contents of the deleted bundle. If the request results in a cache hit, the read also triggers restoration of the deleted object into R2 storage, meaning the operator's deletion operation is silently reversed. The attacker can repeat retrieval across the restoration window, and any other party with the same cached URL gains the same access. Recovered bundles may contain client-side logic, embedded identifiers, endpoint references, or other material the publisher removed deliberately for security, licensing, or competitive reasons.

At the time of writing there is no evidence of exploitation in the wild, no CISA KEV listing, and no EPSS score published by FIRST.org.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base score 7.5 (HIGH).

• AV:N — the public file read endpoint is internet-reachable, so exploitation is remote.
• AC:L — the condition is a missing check, not a race or a memory-safety primitive; a single well-formed request is sufficient where a valid URL is known.
• PR:N — no authentication or role is required.
• UI:N — no victim action is needed; the attacker acts directly against the service.
• S:U — impact is scoped to the Capgo deployment and its storage backend.
• C:H — deleted bundle contents are fully disclosed to an unauthorized party.
• I:N / A:N — no direct destruction or denial of service is scored in the vector, though the described restoration of deleted objects into R2 storage is a state mutation whose downstream consequences (storage cost, extended exposure window, defeat of deletion-based compliance workflows) sit outside the scored confidentiality loss.

Blast radius. Any organization running an affected Capgo version and relying on deletion of bundles as a security or data-retention control is exposed. Because discovery depends on possession of a previously valid URL rather than brute-force enumeration, likely victims are those whose bundle URLs have leaked through mobile client packages, logs, or third-party references. The most significant business risk is the silent reversal of a deletion operation: teams that removed a bundle to pull a leaked secret, a deprecated integration, or regulated content may believe the artifact is gone while it remains retrievable and has been re-persisted to storage.

Detection Guidance

Sigma Rule

title: Capgo Public File Read Endpoint Access to Deleted Bundle Artifacts
id: 7c1e9a24-5b3d-4f10-9c8e-2a6d4f0b91c3
status: experimental
description: Detects repeated unauthenticated reads of Capgo bundle artifacts, including URLs referencing previously deleted bundles, indicative of CVE-2026-100622 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100622
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'GET'
    cs-uri-stem|contains: 'bundle'
  selection_status:
    sc-status: 200
  filter_legit:
    cs-uri-query|contains: 'deleted=true'
  condition: selection_endpoint and selection_status and not filter_legit
falsepositives:
  - Legitimate client update checks pulling current bundles
  - Internal CDN health checks
level: medium
tags:
  - attack.t1213
  - cve.2026-100622
  - cwe.200

YARA Rule

rule CVE_2026_100622_Capgo_Deleted_Bundle_Read
{
    meta:
        description = "Detects HTTP requests targeting Capgo public file read endpoint for bundle artifacts, associated with CVE-2026-100622 deleted bundle disclosure"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100622"
        cve = "CVE-2026-100622"

    strings:
        $m1 = "GET " ascii nocase
        $u1 = "bundle" ascii nocase
        $u2 = "capgo" ascii nocase
        $h1 = "HTTP/" ascii nocase
        $a1 = "deleted" ascii nocase

    condition:
        $m1 and $h1 and ($u1 or $u2) and filesize < 4096
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100622 Capgo Deleted Bundle Artifact Read Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"bundle"; nocase; http.uri; content:"capgo"; nocase; http.header; content:"User-Agent"; classtype:attempted-recon; reference:cve,2026-100622; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100622; sid:2026100622; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "GET"
      and url.path : "*bundle*" and http.response.status_code == 200 ]
  [ network where network.protocol == "http" and http.request.method == "GET"
      and url.path : "*bundle*" and http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx
| search method=GET uri_path="*bundle*"
| eval deleted_ref=if(match(uri_path, "(?i)deleted"), 1, 0)
| stats count AS requests
        values(status) AS status_codes
        values(src_ip) AS client_ips
        by uri_path deleted_ref
| where deleted_ref=0 AND requests > 5
| sort - requests
| table uri_path, requests, status_codes, client_ips

Wazuh OSSEC Rule

<group name="web,cve_2026_100622,">
  <rule id="100622" level="7">
    <if_sid>31100</if_sid>
    <id>^200$</id>
    <match>GET</match>
    <regex>/bundle</regex>
    <description>CVE-2026-100622: Possible Capgo deleted bundle artifact read via public file endpoint</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_100622,data_exposure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (no vendor patch available):

• Enforce deletion-status verification at the edge: configure WAF, reverse proxy, or CDN rules to reject requests for artifacts known to be deleted, rather than relying on the upstream serving path.
• Avoid persisting long-lived public URLs for bundle artifacts where operationally possible; treat any previously distributed URL as still valid until the vendor fixes the read path.
• Monitor R2 storage for unexpected object re-appearance in bundle prefixes; any restoration of a deleted object should be treated as evidence that the vulnerable code path was exercised.
• Rate-limit and log all unauthenticated reads of the public file read endpoint, and alert on sequential or repeated fetches of a single bundle path.
• If bundles have ever contained secrets or regulated data, consider rotating any material that was embedded in now-deleted bundles rather than assuming deletion held.

2) Patch / upgrade steps:

• No vendor patch or official advisory with a fixed version is available from tracked sources. Monitor the Capgo project's release channel and this CVE record for a fixed version beyond 12.129.0.
• When a fix is released, upgrade immediately and verify post-upgrade that requests for deleted bundles return a not-found or gone response rather than artifact bytes, and that no restoration to R2 storage occurs on such requests.

3) Long-term hardening:

• Require deletion-state checks on every read path, not only in administrative or write paths; treat object lifecycle state as a mandatory authorization input.
• Separate read serving from storage restoration logic so that a read can never mutate persistence state.
• Introduce negative-cache semantics for deleted artifacts so stale entries cannot be served and cannot resurrect backing objects.
• Add regression tests that assert deleted bundle URLs fail closed, and instrument storage-layer metrics for object resurrections.
• Reassess data-retention and deletion guarantees for any artifact class served from public endpoints, and validate them with external, unauthenticated probes.

References

• NVD — CVE-2026-100622: https://nvd.nist.gov/vuln/detail/CVE-2026-100622
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST.org EPSS (no score published for this CVE as of this report): https://www.first.org/epss
• Capgo project releases / changelog (monitor for fixed version beyond 12.129.0): https://github.com/Cap-go

Threat actor campaigns: none attributed. Exploit-in-the-wild evidence: none observed. CISA KEV: not listed. Public PoC, exploit code, and Nuclei template: unavailable.