CVE-2026-69113

Published: Aug 11, 2026Modified: Aug 14, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (5)

https://github.com/CapSoftware/Cap

Source: disclosure@vulncheck.com

https://github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c9d

Source: disclosure@vulncheck.com

https://github.com/CapSoftware/Cap/issues/1982

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/cap-broken-access-control-via-video-comment-endpoint

Source: disclosure@vulncheck.com

https://github.com/CapSoftware/Cap/issues/1982

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.