CVE-2026-53867
Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 12, 2026
- Updated
- Sep 24, 2026
- Reserved
- Jun 10, 2026
Description
Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-459 Incomplete Cleanup
Affected Products
| Product | Versions |
|---|---|
CapgoCapgo |
|
References
- GHSA Advisory GHSA-8p92-wcp2-c9j4vendor-advisory
- VulnCheck Advisory: Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacementthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.