{"id":"CVE-2026-53867","aliases":[],"cve":{"records":[{"id":"CVE-2026-53867","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-10T21:23:54.283Z","published":"2026-06-12T21:57:02.653Z","modified":"2026-11-08T14:05:07.539Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T14:05:07.539Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-06-15T19:26:27.894Z"}],"references":[{"url":"https://github.com/Cap-go/capgo/security/advisories/GHSA-8p92-wcp2-c9j4","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/capgo-orphaned-file-retention-via-profile-image-replacement","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-459","description":"Incomplete Cleanup","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-06-15T16:52:41.414750Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.","score":5.3,"severity":"medium","published":"2026-06-12T21:57:02.653Z","modified":"2026-11-08T14:05:07.539Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Capgo","name":"Capgo","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"12.128.2","versionType":"semver"},{"version":"12.128.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:github/Cap-go/capgo","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-53867"}],"remediation":[],"references":["https://github.com/Cap-go/capgo/security/advisories/GHSA-8p92-wcp2-c9j4","https://www.vulncheck.com/advisories/capgo-orphaned-file-retention-via-profile-image-replacement"],"sources":[{"name":"CVE","id":"CVE-2026-53867","modified":"2026-11-08T14:05:07.539Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-53867"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}],"sourceAffected":[],"observedAt":"2026-11-08T14:23:45.266Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:50:31.991Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T00:05:34.822Z","attemptedAt":"2026-11-09T00:05:34.822Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T00:05:34.982Z","attemptedAt":"2026-11-09T00:05:34.982Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T00:05:35.604Z","attemptedAt":"2026-11-09T00:05:35.604Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T00:05:34.825Z","attemptedAt":"2026-11-09T00:05:34.825Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-53867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53867","modified":"2026-07-23T09:10:00.113","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-09T00:05:34.822Z"},{"source":"NVD","id":"CVE-2026-53867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53867","modified":"2026-07-23T09:10:00.113","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-09T00:05:34.822Z"},{"source":"FIRST EPSS","id":"CVE-2026-53867","url":"https://www.first.org/epss/","probability":0.00183,"percentile":0.07951,"date":"2026-11-08","checkedAt":"2026-11-09T00:05:34.825Z"},{"source":"GitHub Advisory Database","id":"GHSA-g9f3-8379-v2hf","url":"https://github.com/advisories/GHSA-g9f3-8379-v2hf","modified":"2026-06-13T00:34:39Z","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-09T00:05:34.982Z"},{"source":"ENISA EUVD","id":"EUVD-2026-36628","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36628","modified":"Nov 8, 2026, 2:05:07 PM","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-09T00:05:35.604Z"}],"aiSummary":{"text":"Capgo versions before 12.128.2 fail to delete previous profile images from storage when replaced or removed, allowing attackers to access them via previously generated URLs. This is due to incomplete cleanup. Attackers need access to the previously generated URLs.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T15:51:03.776Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-53867"}]}}