CVE-2026-100622

7.5 HIGHpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p
https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p

All references

https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p
https://www.vulncheck.com/advisories/capgo-app-through-12.129.0-cache-restoration-of-deleted-bundles
https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100241
UNSCOREDCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
MEDIUMCVE-2026-100418PoC
MEDIUMCVE-2026-100528PoC
HIGHCVE-2026-100543PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.