Dashboard / CVE-2026-53867

CVE-2026-53867

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-06-12 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: Low
VI: None
VA: None

Description

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Capgo Capgo 0 < 12.128.2

References & Advisories (2)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001830
Percentile 8.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00183
2026-11-12
0.00183
2026-11-10
0.00183
2026-11-09
0.00183
2026-11-08
0.00183

Intelligence Sources

mitre ref →

External Links