Capgo.app versions prior to 12.264.5 allow an authenticated user with the app.build_native permission to bypass the upload expiration time imposed by the build upload API. This is an example of CWE-613 (Restricted Range Validation Without Enforcement). When the /build/upload/:jobId endpoint forwards requests to the internal builder, it only verifies that the caller holds that permission and does not enforce the upload_expires_at timestamp or the build lifecycle state. Consequently an attacker can continue to write to a build’s upload session after the one‑hour expiry window has passed or after the build process has moved beyond the upload phase. This flaw enables an attacker to modify or replace build artifacts beyond the intended timeframe, potentially compromising subsequent deployment, release integrity, or the end‑user’s experience.

Capgo.app (Cap-go:capgo.app) prior to version 12.264.5 are affected. Version 12.264.5 and later include the fix that enforces upload expiry and build lifecycle checks on the /build/upload/:jobId endpoint.

The CVSS score of 5.3 indicates a moderate overall risk. The EPSS score is not available, and the flaw is not listed in CISA KEV, suggesting no widespread exploitation is known. Attackers require legitimate authentication and possession of the app.build_native permission; the attack vector is therefore an authenticated, application‑level approach. Exploitation hinges on the internal builder service not independently rejecting the request, meaning the misconfiguration could be leveraged if the builder service’s own validations are insufficient. Immediate patching is recommended to eliminate this authorization bypass scenario.