CVE-2026-53867CWE-459

Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement

Medium · published June 12, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2026-06-12T21:57Z
EPSS history
Timeline
  • 12 JUN 21:57Z
    Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement
    cvelistv5