CVE-2026-53867

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-459

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-538687.5Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses witCVE-2026-538697.5Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and OriCVE-2026-53879.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or SiCVE-2026-538705.5Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing cCVE-2026-538718.1Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticateCVE-2026-538727.5picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary serverCVE-2026-538739.8picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function,CVE-2026-538749.8picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding CVE-2026-538757.1picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magicCVE-2026-538768.6RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution witCVE-2026-538774.8An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffCVE-2026-538786.1An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (
CVE-2026-53867: Medium severity, CVSS 4.3 | Vulnix