CVE-2026-53867

Vulnerability

In Capgo versions before 12.128.2, when a user uploads a profile image and later replaces or removes it via the profile section, the application updates the database reference but does not delete the previously uploaded image from backend storage [1]. This results in orphaned files that remain accessible through their previously generated URLs [2].

Exploitation

An attacker with knowledge of a previously generated image URL can access the orphaned file without authentication beyond the initial user session [1]. The attacker does not need special privileges; any user who has the URL can retrieve the image [2].

Impact

Successful exploitation allows unauthorized retrieval of user-uploaded profile images, leading to information disclosure [1]. The attacker gains access to content the user intended to remove [2].

Mitigation

Upgrade to Capgo version 12.128.2 or later, which fixes the issue by properly deleting orphaned images upon replacement or removal [1]. No workaround is documented [2].