Capgo's native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) authorizes a caller against a single build job identified by builder_job_id and validates only that job's stored upload_path. However, the proxy forwards a user-controlled TUS resource suffix from the URL path to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is not bound to the authorized job's upload_path or upload_session_key, an attacker with a valid 'all' or 'write' Capgo API key and app.build_native permission for one application can misuse the proxy path for job A to write to the TUS upload resource of another job B if the resource suffix is known or exposed. This can lead to corruption of build artifacts. The vulnerability affects all versions of Capgo, and no patch was available at the time of the advisory.

An attacker with valid Capgo API keys and appropriate permissions for one application can exploit this vulnerability to write to the upload resources of other build jobs, potentially corrupting build artifacts. This undermines the integrity of the build process and could disrupt software delivery or introduce malicious modifications. The vulnerability does not require user interaction or privileges beyond the specified API key permissions.

No patch was available at the time of the advisory publication. Users should monitor the vendor's advisory for updates and apply official fixes once released. Until a fix is available, restrict API key permissions to the minimum necessary and avoid exposing resource suffixes that could be used to target other jobs. Review and limit access to Capgo API keys with 'all' or 'write' permissions and app.build_native scope to trusted entities only.