The vulnerability in Capgo.app prior to version 12.264.5 involves insufficient session expiration enforcement in the /build/upload/:jobId TUS proxy endpoint. Although an upload_expires_at timestamp and a 'pending' status are stored when a native build request is created, the proxy endpoint only verifies app.build_native permission and certain identifiers without checking upload expiry or build lifecycle state. Consequently, an authenticated caller with the required permission can continue to write to the upload session beyond the intended expiry time or after the build has progressed past the upload phase, potentially leading to unauthorized or unintended build uploads. The issue is resolved in version 12.264.5.

An authenticated user with app.build_native permission can continue uploading data to a build session after the session's intended expiration or after the build phase has ended. This could lead to unauthorized modifications or uploads to builds beyond their expected lifecycle. The impact is limited to users with the specific permission and does not involve privilege escalation or remote unauthenticated access. No known exploits are reported in the wild.

Upgrade Capgo.app to version 12.264.5 or later, where this issue is fixed. Until then, ensure that the builder service independently enforces upload expiry and build lifecycle state to prevent unauthorized uploads beyond session expiration.