Capgo EUVD-2026-87720

Requires a valid Capgo API key of scope 'all' or 'write' carrying app.build_native permission for at least one application the attacker controls, plus an active/authorized build job (job A) to obtain a legitimate proxy path. The decisive precondition is that the attacker must know or have exposed to them the TUS resource suffix of a different build job (job B) - the flaw is that the forwarded /build/upload/:jobId/* suffix is never bound to the authorized job's upload_path or upload_session_key. Limiting factors: authenticated access is mandatory (not anonymous), the target job's resource suffix must be discoverable, and the impact is confined to corrupting build artifacts (write/integrity) with no read/exfiltration or availability takedown. Affects all versions; no patch available at advisory publication.

This is a genuine but access-gated integrity flaw, not a raw-critical priority. The vendor's CVSS 4.0 8.7 is inflated on two axes. First, PR:N is inconsistent with the description, which explicitly requires 'a valid all or write Capgo API key with app.build_native permission' - this is authenticated exploitation (PR:L), not open to anonymous attackers. Second, VC:H (confidentiality high) mislabels the impact: the described action is a cross-job WRITE that corrupts another build's artifacts, with no read/exfiltration path, so the true impact is integrity (VI/SI), not confidentiality. A further limiter the vendor's AC:L ignores: the attack only works 'provided that resource suffix is known or exposed' - the attacker must learn another job's TUS resource suffix, a non-trivial precondition (AC:H). No EPSS score, no CISA KEV listing, and no public POC accompany this advisory, so there is no signal of active or imminent exploitation - status is 'no public exploit identified at time of analysis.' Net: a real supply-chain-integrity confused-deputy bug (CWE-441 correctly assigned) worth patching for anyone running Capgo's native-build pipeline, but the authenticated-plus-known-suffix gating and integrity-only impact place it below the vendor's 8.7. Key conflict to verify with vendor: CVSS vector claims PR:N/VC:H while the description establishes an authenticated write-only corruption.

An attacker who legitimately holds a Capgo 'all' or 'write' API key with app.build_native permission for one of their own applications initiates a native build (job A) and obtains its authorized upload proxy path. Knowing or discovering the TUS resource suffix of another tenant's build job B, they issue TUS upload requests through their job-A proxy path but target job B's resource; the proxy injects Capgo's privileged builder key and forwards the write, corrupting job B's build artifacts. No public exploit code is known at time of analysis.