CVE-2026-100622

HIGHCVSS 7.5

Description

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits.

Timeline

Published:September 26th, 2026 2:16 PM

Last modified:September 28th, 2026 8:57 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

References & Reports

Advisories, patches, and third-party reports

https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p
https://www.vulncheck.com/advisories/capgo-app-through-12.129.0-cache-restoration-of-deleted-bundles
https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p

Source: NIST NVD · Data may lag official sources by up to one minute