CVE-2026-53867
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Jun 12, 2026
CISA due date
—
The record
Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109276 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw… CWE-459
- CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after… CWE-459
- CVE-2026-88932 multer is a Node.js middleware for handling multipart/form-data uploads. CWE-459
- CVE-2026-87776 compression is a Node.js and Express compression middleware. CWE-459
- CVE-2026-87549 Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
- CVE-2026-87446 Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
- CVE-2026-87436 Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
- CVE-2026-85043 Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote… CWE-459