CVE-2026-100624

Executive Summary

CVE-2026-100624 is an Insufficient Session Expiration vulnerability (CWE-613) in Capgo.app versions prior to 12.264.5. The flaw allows an authenticated user with the app.build_native permission to continue writing to a native build upload session via the /build/upload/:jobId TUS proxy endpoint, even after the one-hour upload_expires_at timestamp has passed or after the build has progressed beyond the upload phase. While the CVSS score is moderate (5.4), the vulnerability undermines build lifecycle integrity controls, potentially enabling unauthorized persistence in the build pipeline and resource exhaustion.

Technical Analysis

The vulnerability resides in the TUS (resumable upload) proxy endpoint /build/upload/:jobId. When a native build request is initiated, the application correctly stores an upload_expires_at timestamp (set to one hour) and a pending status in the build_requests table. However, the upload proxy endpoint fails to enforce these lifecycle constraints. According to the NVD description, the proxy "loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission before forwarding POST, PATCH, and HEAD requests to the internal builder."

This means the endpoint performs authorization based solely on the static app.build_native permission, ignoring the temporal (upload_expires_at) and state (pending status) attributes that should govern whether an upload session is still valid. Consequently, an attacker who possesses the app.build_native permission for a given app can continue to interact with an expired or completed build job's upload session. The flaw does not bypass authentication entirely but circumvents lifecycle-based session controls, allowing unauthorized write operations to persist.

The attack surface is the publicly exposed TUS proxy endpoint, which forwards requests to an internal builder service. The vulnerability is classified as CWE-613 (Insufficient Session Expiration), highlighting the failure to invalidate or reject sessions after their intended expiration. The impact is bounded by the requirement for the app.build_native permission and the fact that the internal builder service may still independently reject requests, though this is not guaranteed.

Exploitation Scenarios

Reconnaissance: An attacker with a valid account and the app.build_native permission for a target application identifies the /build/upload/:jobId endpoint. This may be achieved by monitoring network traffic during legitimate build operations or by reviewing API documentation. The attacker also needs to know or guess a valid jobId associated with a build request. Since jobId is likely a predictable or enumerable identifier (e.g., UUID), the attacker could attempt to enumerate existing job IDs or capture them from prior interactions.

Triggering the flaw: The attacker initiates a native build request for the app, which creates a build_requests record with a one-hour upload_expires_at and pending status. After this period elapses, or after the build has moved beyond the upload phase (e.g., status changed to building or completed), the attacker sends a POST, PATCH, or HEAD request to /build/upload/:jobId. Because the proxy only validates the app.build_native permission and does not check the expiry timestamp or current status, the request is forwarded to the internal builder.

Payload/execution: The attacker can then write arbitrary data to the build upload session. This could involve uploading malicious files or scripts that are later incorporated into the build artifact, or simply consuming storage and compute resources by continuously uploading data. The exact payload depends on how the internal builder processes uploaded files, but the vulnerability class allows unauthorized modification of build inputs.

Post-exploitation impact: Successful exploitation could lead to build integrity compromise (e.g., injecting malicious code into the final app), resource exhaustion on the internal builder, or persistent unauthorized access to the build pipeline. The attacker could maintain a foothold by repeatedly writing to the session, potentially bypassing other controls that rely on session expiry. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) indicates low confidentiality impact, low integrity impact, and low availability impact, but the actual impact may be higher if the internal builder does not independently reject requests.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The vulnerability affects Capgo.app deployments that allow users with the app.build_native permission. The blast radius is limited to applications for which the attacker has this permission, but within that scope, the attacker can manipulate build upload sessions after they should be invalid. Business impact includes potential supply chain risks if malicious code is injected into built artifacts, as well as operational disruption from resource exhaustion. The CVSS score of 5.4 reflects a moderate severity: network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and low availability impact (A:L). The integrity and availability impacts are contained but non-zero, underscoring the need for timely remediation.

Detection Guidance

Sigma Rule

title: Capgo Build Upload Session Expiry Bypass
id: 9b3e1a2c-4f7d-4e8a-9c1b-2d3e4f5a6b7c
status: experimental
description: Detects attempts to upload to a build session after expiry or completion
author: Security Team
date: 2026-05-12
logsource:
  category: webserver
  product: capgo
detection:
  selection:
    cs-method: 
      - 'POST'
      - 'PATCH'
      - 'HEAD'
    cs-uri-stem|startswith: '/build/upload/'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate uploads within the allowed time window
level: medium
tags:
  - attack.t1190
  - cve.2026-100624

YARA Rule

rule CVE_2026_100624_Capgo_Upload_Bypass
{
    meta:
        description = "Detects Capgo build upload requests bypassing expiry"
        author = "Security Team"
        date = "2026-05-12"
        reference = "CVE-2026-100624"
        severity = "medium"
    strings:
        $endpoint = "/build/upload/"
        $method1 = "POST"
        $method2 = "PATCH"
        $method3 = "HEAD"
        $perm = "app.build_native"
    condition:
        any of ($method*) and $endpoint and $perm
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100624 Capgo Build Upload Session Expiry Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/build/upload/"; http_uri; content:"app.build_native"; http_header; classtype:attempted-user; sid:1000624; rev:1;)

Elastic Detection

sequence by user.name
  [http where http.request.method in ("POST", "PATCH", "HEAD") and url.path : "/build/upload/*"]
  [http where http.request.method in ("POST", "PATCH", "HEAD") and url.path : "/build/upload/*"]

Splunk SPL Query

index=web_logs sourcetype=access_combined
| search method IN ("POST", "PATCH", "HEAD") AND uri_path="/build/upload/*"
| rex field=uri_path "/build/upload/(?<jobId>[^/]+)"
| stats count by jobId, src_ip, user
| where count > 1

Wazuh OSSEC Rule

<group name="capgo,">
  <rule id="100624" level="7">
    <decoded_as>json</decoded_as>
    <field name="method">POST|PATCH|HEAD</field>
    <field name="url">/build/upload/</field>
    <description>CVE-2026-100624: Potential Capgo build upload session expiry bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

1. Immediate mitigations: Restrict network access to the /build/upload/:jobId endpoint to trusted IP ranges or internal networks. Implement a reverse proxy rule to reject POST/PATCH/HEAD requests to this endpoint if the upload_expires_at timestamp has passed (requires custom logic). Monitor logs for repeated upload attempts to the same jobId outside the expected window.

2. Patch/upgrade steps: Upgrade Capgo.app to version 12.264.5 or later. The patch enforces upload expiry and build lifecycle state checks in the TUS proxy endpoint. Verify the internal builder service also rejects expired or completed uploads as a defense-in-depth measure.

3. Long-term hardening: Implement centralized session lifecycle management that validates both authorization and temporal/state constraints. Avoid relying solely on permission checks for access control. Conduct regular security audits of build pipelines and integrate automated testing for session expiration bypasses. Consider using short-lived tokens for build uploads that are cryptographically bound to the job state.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100624
• CWE-613: Insufficient Session Expiration: https://cwe.mitre.org/data/definitions/613.html
• Capgo.app Release Notes: https://github.com/Cap-go/capgo/releases/tag/v12.264.5
• TUS Protocol Specification: https://tus.io/protocols/resumable-upload
• No known exploit-in-the-wild or threat actor campaigns associated with this CVE at this time.