High severity7.5NVD Advisory· Published Sep 26, 2026

CVE-2026-100622

Description

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cap Go/Capgo.appllm-fuzzy
Range: <=12.129.0

Patches

Vulnerability mechanics

References

github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989pnvd
www.vulncheck.com/advisories/capgo-app-through-12.129.0-cache-restoration-of-deleted-bundlesnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000