CVE-2026-56298

MediumCVSS 4.3/10Last modified Jul 8, 2026

Description

Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata from uploaded files.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-562995.3Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attCVE-2026-56304.3A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.CVE-2026-563007.5Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key vaCVE-2026-563015.5Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server toCVE-2026-563026.5Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to reaCVE-2026-563037.5Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINCVE-2026-563046.5picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-CVE-2026-563058.3Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user pCVE-2026-563066.4Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcemenCVE-2026-563074.3Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path thCVE-2026-563087.3Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing emaiCVE-2026-563095.4Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to crea
CVE-2026-56298: Medium severity, CVSS 4.3 | Vulnix