What is GHSA-h3qx-vqw8-rv67?

GHSA-h3qx-vqw8-rv67 is a security advisory published by GitHub Security Advisories with High severity. capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts...

Which CVE IDs does GHSA-h3qx-vqw8-rv67 cover?

GHSA-h3qx-vqw8-rv67 covers the following CVE IDs: CVE-2026-100622. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h3qx-vqw8-rv67?

GHSA-h3qx-vqw8-rv67 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-h3qx-vqw8-rv67HighCVSS 7.5

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-100622 →

📋 Description

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits.

🔗 References (4)

https://github.com/Cap-go/capgo.app/security/advisories/GHSA-26x3-6mr7-989p
https://nvd.nist.gov/vuln/detail/CVE-2026-100622
https://www.vulncheck.com/advisories/capgo-app-through-12.129.0-cache-restoration-of-deleted-bundles
https://github.com/advisories/GHSA-h3qx-vqw8-rv67