CVE-2026-100625

Executive Summary

CVE-2026-100625 is an authorization bypass (confused deputy, CWE-441) in Capgo's native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts). The proxy authorizes a caller against a single build job but forwards a user-controlled TUS resource suffix — taken from /build/upload/:jobId/* — to the builder service while injecting Capgo's privileged builder API key, without binding that suffix to the authorized job's upload_path or upload_session_key. A caller holding a valid all or write Capgo API key with app.build_native permission for one application can write to another job's TUS upload resource if the suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at advisory publication.

Technical Analysis

Capgo (capgo.app) provides over-the-air update and native build services for mobile applications. The vulnerable component is a Supabase Edge Function acting as a native build TUS upload proxy, located at supabase/functions/_backend/public/build/upload.ts. The proxy's purpose is to relay client upload requests to an internal builder service. Because the builder service trusts requests carrying Capgo's privileged builder API key, the proxy functions as a trusted intermediary.

The flaw is an Authorization Bypass Through User-Controlled Key / confused deputy condition. Two authorization checks occur but are decoupled from the actual operation performed:

1. The proxy authorizes the caller against a single build job, identified by the caller-supplied builder_job_id.
2. It validates only that job's stored upload_path.

However, the proxy then extracts the TUS resource suffix from the request path /build/upload/:jobId/* and forwards it to the builder service verbatim, while injecting Capgo's privileged builder API key. Critically, the forwarded suffix is never bound to the authorized job's upload_path or upload_session_key. There is no check that the suffix being forwarded corresponds to the job that passed authorization.

This creates a type-confusion between "the job I am authorized for" and "the resource I am writing to." A caller who holds a valid all or write Capgo API key with app.build_native permission for one application can authenticate the request using their legitimate job A, but supply a resource suffix belonging to job B. Because the builder service sees the privileged API key and a syntactically valid suffix, it accepts the write against job B's TUS upload resource. The known-or-exposed upload_session_key (or equivalent suffix component) is the only prerequisite for targeting a specific victim job.

No public proof-of-concept exists and this report does not fabricate specific internal implementation details beyond those stated in the advisory. The vulnerability class (server-side request forwarding with attacker-controlled path segments, insufficient key binding, and privileged credential injection) is well understood: the proxy trusts a path-derived identifier without cross-validating it against the authorization subject.

Exploitation Scenarios

Note: No public PoC is available; the following attack chain is inferred strictly from the vulnerability class and the advisory description. No hypothetical function names or endpoints beyond those in the description are used.

1. Reconnaissance / target identification. The attacker operates a legitimate or trial Capgo account with at least all or write scope and the app.build_native permission for one application. They enumerate or otherwise determine a valid builder_job_id for their own app and — more importantly — identify the TUS resource suffix (e.g., the upload_session_key component) for a victim build job B. Per the advisory, this is possible "provided that resource suffix is known or exposed." Suffixes may leak via logs, shared build references, UI exposure, or predictable identifiers.

2. Triggering the flaw class. The attacker sends a TUS upload request to the proxy at the path /build/upload/:jobId/*, supplying:

   • a builder_job_id corresponding to their own authorized job A (so the authorization check passes and job A's upload_path validates), and
   • a resource suffix (*) that actually belongs to victim job B.

   Because the proxy validates only job A's upload_path but forwards the attacker-controlled suffix verbatim — without binding it to job A's upload_path or upload_session_key — the authorization check is satisfied while the write targets job B.

3. Payload / execution method. The proxy attaches Capgo's privileged builder API key and relays the TUS upload toward the builder service. At the vulnerability-class level, this is a privileged write primitive: instead of the expected build artifact content, the attacker supplies attacker-controlled bytes destined for job B's upload resource.

4. Post-exploitation impact. The attacker's content is written into victim job B's TUS upload resource, corrupting that build's artifacts. The advisory characterizes the effect as artifact corruption (integrity impact). This can cause a victim's native build to produce tampered binaries, fail integrity checks, or distribute altered artifacts downstream — a potential software supply chain concern for the affected application's build pipeline. The advisory assigns this an Integrity:High impact with limited/no Availability and no Confidentiality impact.

Impact Assessment

CVSS v3.1 base score: 7.1 (High) — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L.

• Attack Vector (Network): Exploitable remotely via the public upload proxy over HTTP/TUS.
• Attack Complexity (High): Requires the attacker to know or expose the victim resource suffix; this precondition accounts for the High rating rather than Low.
• Privileges Required (Low): Requires a valid Capgo API key with all or write scope and app.build_native permission — a low but non-zero barrier.
• User Interaction (None): No victim user action required.
• Scope (Changed): The attack crosses a security boundary — a request authorized in the context of job A affects job B, a separate authorization realm; hence Scope:Changed.
• Confidentiality (None): No data disclosure described.
• Integrity (High): Build artifacts are corrupted/tampered, directly undermining artifact trustworthiness.
• Availability (Low): Corrupted builds may fail to build or deploy, causing limited availability impact.

Blast radius: Any Capgo tenant whose build resource suffix is known or exposed is a potential target. The corrupted artifact may propagate to end-user devices via OTA/native builds, making this relevant to mobile app supply chain integrity. Because the privilege check is tied to one application while the effect targets another, cross-tenant impact is plausible where suffixes are guessable or leak.

Detection Guidance

Sigma Rule

title: Capgo Build Upload Proxy Cross-Job TUS Suffix Mismatch (CVE-2026-100625)
id: 9c2a7f1e-0b3d-4e58-9a11-capgo100625
status: experimental
description: Detects requests to the Capgo native build TUS upload proxy where the supplied builder_job_id and the TUS resource suffix may not correspond to the same authorized job, indicating attempted authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100625
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: supabase
detection:
  selection_path:
    cs-uri-stem|contains: '/build/upload/'
  selection_method:
    cs-method|in:
      - POST
      - PATCH
      - PUT
  selection_suffix:
    cs-uri-stem|contains: '/build/upload/'
  condition: selection_path and selection_method
  # Escalate to investigation when a single API key submits uploads
  # referencing multiple distinct builder_job_id / suffix combinations.
falsepositives:
  - Legitimate sequential uploads for a single job
level: medium
tags:
  - attack.t1190
  - cve.2026.100625

YARA Rule

rule CVE_2026_100625_Capgo_TUS_CrossJob
{
    meta:
        description = "Detects Capgo native build TUS upload proxy requests attempting cross-job resource suffix forwarding (CVE-2026-100625)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100625"
        date = "2026-01-01"

    strings:
        $ep1 = "/build/upload/" ascii wide nocase
        $f1  = "builder_job_id" ascii wide nocase
        $f2  = "upload_path" ascii wide nocase
        $f3  = "upload_session_key" ascii wide nocase
        $tus = "Tus-Resumable" ascii wide nocase

    condition:
        $ep1 and $f1 and ($f2 or $f3) and $tus
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100625 Capgo Build TUS Upload Cross-Job Suffix Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/build/upload/"; http.header; content:"Tus-Resumable"; reference:cve,2026-100625; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100625; classtype:attempted-user; sid:2026100625; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [http where http.request.method in ("POST","PATCH")
     and url.path like "/build/upload/*"
     and http.request.body.text contains "builder_job_id"]
  [http where http.request.method in ("POST","PATCH")
     and url.path like "/build/upload/*"
     and http.request.headers.text contains "Tus-Resumable"]

Splunk SPL Query

index=web OR index=supabase sourcetype=access_combined OR sourcetype=*edge*
    uri_path="/build/upload/*"
    (http_method=POST OR http_method=PATCH)
| rex field=uri_path "/build/upload/(?<jobId>[^/]+)/(?<suffix>.*)"
| stats dc(jobId) as distinct_jobs dc(suffix) as distinct_suffixes by src_ip, api_key
| where distinct_jobs > 1 OR distinct_suffixes > 1
| sort - distinct_jobs

Wazuh OSSEC Rule

<group name="capgo,cve-2026-100625,">
  <rule id="2026100" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/build/upload/</url>
    <description>CVE-2026-100625: Capgo build TUS upload proxy access - potential cross-job authorization bypass</description>
  </rule>

  <rule id="2026101" level="12">
    <if_sid>2026100</if_sid>
    <regex>builder_job_id</regex>
    <description>CVE-2026-100625: Capgo build upload with builder_job_id parameter - investigate for resource suffix mismatch</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict/rotate Capgo API keys scoped with all or write and app.build_native; apply least privilege so keys are bound to a single application only.
• Audit all builder_job_id and TUS resource suffix values to identify exposure/leakage; treat upload_session_key values as sensitive.
• Where possible, disable or gate the native build TUS upload proxy until an upstream fix is available.
• Monitor for cross-job upload activity (see Detection Guidance) and alert on any API key submitting uploads referencing more than one builder_job_id or suffix.

2) Patch / upgrade steps

• No vendor patch was available at advisory publication. Track Capgo release notes and the vendor advisory for a fixed version. Once a fix is published, the expected remediation is to bind the forwarded TUS resource suffix to the authorized job's upload_path/upload_session_key and reject any suffix that does not correspond to the authorized builder_job_id. Deploy updates immediately upon availability.

3) Long-term hardening

• Enforce strict server-side binding between the authorized object identifier and every forwarded user-controlled path segment (avoid confused deputy patterns).
• Never inject a privileged builder API key into a request whose target resource is derived from attacker-controlled input without full re-authorization.
• Adopt per-job, short-lived upload tokens rather than a shared privileged key.
• Implement artifact integrity verification (signing/hashing) so corrupted or tampered build outputs are detected downstream.
• Conduct authorization review of Supabase Edge Functions that proxy to internal services with elevated credentials.

References

• NVD — CVE-2026-100625: https://nvd.nist.gov/vuln/detail/CVE-2026-100625
• Capgo (capgo.app) — vendor / project: https://capgo.app
• CWE-441: Unintended Proxy or Intermediary ('Confused Deputy'): https://cwe.mitre.org/data/definitions/441.html
• CVSS v3.1 Specification (FIRST): https://www.first.org/cvss/v3.1/specification-document
• OWASP — Authorization Bypass / Broken Access Control: https://owasp.org/Top10/A01_2021-Broken_Access_Control/

No threat actor campaigns, exploit-in-the-wild evidence, or CISA KEV listing are associated with this CVE at the time of writing. No public PoC or exploit code was available; the attack chain described is inferred from the vulnerability class.