VULNERABILITY INTELLIGENCE
CVE-2026-53867
CVSS score4.3 MEDIUM
EPSS probability0.18%
CISA KEVNot currently listed
Published2026-06-12
Last modified2026-07-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.
Weakness classification
- disclosure@vulncheck.com: CWE-459