Capgo CVE-2026-53867

Exploitation requires that the attacker already possesses or can enumerate a previously generated profile image URL from the Capgo backend storage; this is the single concrete prerequisite. The CVSS PR:L metric indicates that initially generating such a URL requires at least low-privilege authenticated interaction with the Capgo platform. Once a URL is known, the 'Authentication Bypass' tag suggests the storage layer does not validate an auth token on retrieval - meaning the URL itself is the only credential. Exploitation is limited to read access of profile image content only; no write, delete, account takeover, or lateral movement capability is implied. The vulnerability does not affect Capgo deployments where the profile image upload feature is unused or disabled. The realistic attacker population is constrained to parties who previously interacted with or observed traffic to a targeted user's profile.

The CVSS 4.0 base score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L is proportionate to the real-world risk. The low confidentiality impact (VC:L) correctly reflects that exposed data is limited to user-uploaded profile images rather than credentials, session tokens, or sensitive business records. The PR:L metric meaningfully restricts opportunistic exploitation - an attacker must first have obtained a valid storage URL through authenticated or observed access. There is no KEV listing, no known public exploit code, and no EPSS data provided in the input. The primary risk is a privacy and data-retention compliance concern: GDPR Article 17 (right to erasure) and similar regulations create legal exposure for operators when deleted user data remains accessible. This is not an acute security emergency but warrants prompt patching, particularly for platforms handling sensitive user content. The 'Authentication Bypass' tag warrants verification - if storage URLs are guessable rather than random, the effective prerequisite drops lower than PR:L implies.

An attacker who previously bookmarked, cached, or intercepted a user's profile image URL - for example, via a shared link, a referrer header leak, or a logged HTTP request - submits a plain GET request to that URL after the victim user has replaced or deleted their profile image. Because the storage backend never received a delete instruction and the URL carries no expiring token, the request succeeds and returns the user's old profile image. No exploit tooling or elevated access is required beyond possession of the URL.