Capgo version 12.128.1 and earlier fail to delete previously uploaded profile images from backend storage when users replace or remove them, leaving orphaned files accessible via known URLs. An attacker who can trigger the replacement or removal of a user's profile image can subsequently retrieve the orphans, exposing user‑uploaded content that should no longer be accessible. This flaw is a clear example of CWE‑459, where outdated old data remains available after a service no longer needs it, leading to unintended data disclosure.

The vulnerability affects all installations of Capgo that run a version earlier than 12.128.2, regardless of the deployment environment. The product in question is the Cap‑go open‑source project, typically deployed behind authentication to manage user profiles.

The CVSS score of 5.3 indicates a moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user or attacker who can upload, replace, or delete profile images—common operations in a typical system using Capgo. Once an orphaned file remains, the attacker may simply use the preserved URL to download the content without requiring further privileges. Because the flaw is a data‑lifetime oversight rather than an injection or privilege‑escalation bug, the exploitation does not require special infrastructure, but it does rely on being able to perform normal user actions.