PT-2026-49044 · Cap Go · Cap-Go

Naitik Gupta · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-53867

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2026-53867

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-8p92-wcp2-c9j4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53867 · Security Note
• https://vulncheck.com/advisories/capgo-orphaned-file-retention-via-profile-image-replacement · Note