Executive brief
Capgo, a platform for managing app updates and assets, failed to properly delete user profile images from its storage servers when they were replaced or removed. This means that even after a user deletes a photo, the file remains on the company's servers and can still be viewed by anyone who has the direct link. This flaw could lead to the unintended retention and potential exposure of private user content that was supposed to be deleted.
Technical details
A vulnerability classified as Incomplete Cleanup (CWE-459) exists in Capgo versions prior to 12.128.2. The application updates the profile image reference at the database level but fails to trigger a deletion of the actual object from the backend storage (e.g., S3 or similar cloud storage). An attacker or unauthorized user who previously obtained the direct URL of a profile image can continue to access that content even after the owner has 'deleted' or replaced it via the UI. This issue is reachable over the network and requires low privileges (a valid user account to generate/view URLs), resulting in a loss of data confidentiality and improper data lifecycle management. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-08: advisory: Initial GitHub security advisory published
- 2026-06-12: disclosed: CVE published to NVD dataset