Capgo CVE-2026-56218

Based on the CVSS 4.0 vector (PR:N/UI:N), no authentication is required to retrieve images from affected Capgo instances, and no victim interaction beyond the original upload is needed. The practical prerequisites are: (1) the Capgo instance must be running a version prior to 12.128.2; (2) one or more users must have uploaded images captured with GPS tagging enabled on their device - a common default on iOS and Android; (3) the uploaded images must be retrievable by the attacker, either because they are publicly accessible or because the attacker holds any level of authenticated access to the platform. Exploitation is strictly passive - no code execution, injection, or protocol abuse is required. Limiting factors include: GPS tagging disabled by the end user at the OS level would result in no geolocation EXIF data being present even if the vulnerability exists, and applications that enforce private or authenticated-only image access reduce the attacker's ability to retrieve images.

The CVSS 4.0 score of 6.9 is driven by AV:N/AC:L/AT:N/PR:N/UI:N with VC:L - indicating network-reachable, zero-friction access, no authentication required, and a limited confidentiality impact. While the confidentiality impact metric is rated Low (partial data exposure, not full system access), the real-world privacy consequence of precise GPS location disclosure can be severe for at-risk individuals such as journalists, domestic abuse survivors, or activists. The vulnerability is passive - no exploitation of a code execution path is needed; the attacker simply downloads an image and reads its metadata using freely available tools like ExifTool. No EPSS score was provided in the available intelligence, no CISA KEV listing exists, and no public exploit code has been identified, suggesting this has not seen widespread opportunistic exploitation. The gap between CVSS severity (moderate) and practical privacy harm is notable: defenders should weigh user population sensitivity, not just the numeric score, when prioritizing remediation.

An attacker identifies a publicly accessible Capgo-powered mobile application that allows users to upload photos. The attacker downloads several user-uploaded images from the application's storage endpoint and runs ExifTool or a similar utility to parse the EXIF payload, extracting GPSLatitude and GPSLongitude tags. These coordinates are fed into a mapping service, revealing the precise physical location of the user at the moment of capture - usable for stalking, de-anonymization, or corroborating a user's claimed location.