Summary
Capgo.app through version 12.129.0 may serve deleted bundle artifacts when cached URLs are requested through the public file read endpoint. Because deletion status is not checked on cache hits, unauthenticated users may download data that was intended to be removed and may cause deleted objects to be restored in R2 storage.
Affected context
The issue occurs in deployments of Capgo.app through 12.129.0 that expose the public file read endpoint and use caching for bundle artifacts backed by R2 storage. Risk is present when cached responses remain accessible after an object has been marked for deletion and cache-hit processing does not revalidate the object's current deletion state.
Exploit preconditions
- Attack surface: Public file read endpoint serving cached bundle artifacts
- Required access: No authentication may be required when the endpoint is publicly reachable
- Trigger point: A request for a previously cached URL after the corresponding bundle has been deleted
- Why exploitation is possible: Cache-hit handling can return stale content without verifying deletion status and may cause the deleted object to be restored in R2 storage
Why this happens
The underlying bug is a failure to enforce object lifecycle and authorization state consistently across cached and uncached access paths. A cache hit is treated as sufficient evidence that an artifact remains available, without rechecking whether the underlying bundle has been deleted. This maps to CWE-200, Information Exposure, because data intended to be removed remains obtainable through a public retrieval path.
Potential impact
- Unauthenticated parties may download deleted bundle artifacts
- Confidential application or customer data may remain exposed after deletion
- Deleted objects could be restored into R2 storage through cache-hit behavior
- Retention, deletion, and incident-response policies could be undermined
- Cached artifacts may support further analysis of application contents
General mitigation guidance
Mitigation generally focuses on making deletion state authoritative across every delivery path. Common defensive patterns include revalidating object existence and deletion status before serving cached content, invalidating related cache entries as part of deletion workflows, and preventing cache hits from recreating deleted storage objects. Cache keys and object metadata should be scoped to the appropriate tenant and authorization context, while public access should be avoided for sensitive artifacts. Deletion operations and storage permissions should follow least-privilege principles, with auditability for reads, cache invalidations, and object restoration.
How teams detect issues like this
Detection approaches include static and architectural review of cache-hit paths, searches for public artifact endpoints that bypass authorization or lifecycle checks, and code review of deletion-to-cache invalidation flows. Test suites can verify that deleted objects remain unavailable through both cache hits and origin requests and that cache processing cannot recreate storage objects. Runtime monitoring can flag downloads of deleted identifiers, unexpected cache revalidation failures, and object creation events correlated with public reads. Automated security review tools may help identify missing authorization checks and inconsistent state validation.
