CVE-2026-69113

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/CapSoftware/Cap
https://github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c9d
https://github.com/CapSoftware/Cap/issues/1982
https://www.vulncheck.com/advisories/cap-broken-access-control-via-video-comment-endpoint
https://github.com/CapSoftware/Cap/issues/1982

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Cap v0.3.1 contiene una vulnerabilidad de control de acceso roto en el endpoint POST /api/video/comment que permite a los usuarios autenticados publicar comentarios en cualquier video privado sin permiso al proporcionar un videoId arbitrario en el cuerpo de la solicitud. Los atacantes pueden inyectar comentarios en grabaciones de video privadas pertenecientes a otros usuarios, activar correos electrónicos de notificación de comentarios al propietario del video, y enumerar IDs de video válidos a través de diferencias en la respuesta.

Information

Published : 2026-08-11 18:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-69113

Mitre link : CVE-2026-69113

CVE.ORG link : CVE-2026-69113

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-69113", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69113", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T19:37:26.482761Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "CapSoftware", "product": "Cap", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.3.1"}], "defaultStatus": "affected"}]}], "published": "2026-08-11T18:18:17.847", "references": [{"url": "https://github.com/CapSoftware/Cap", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c9d", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/CapSoftware/Cap/issues/1982", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cap-broken-access-control-via-video-comment-endpoint", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/CapSoftware/Cap/issues/1982", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences."}, {"lang": "es", "value": "Cap v0.3.1 contiene una vulnerabilidad de control de acceso roto en el endpoint POST /api/video/comment que permite a los usuarios autenticados publicar comentarios en cualquier video privado sin permiso al proporcionar un videoId arbitrario en el cuerpo de la solicitud. Los atacantes pueden inyectar comentarios en grabaciones de video privadas pertenecientes a otros usuarios, activar correos electr\u00f3nicos de notificaci\u00f3n de comentarios al propietario del video, y enumerar IDs de video v\u00e1lidos a trav\u00e9s de diferencias en la respuesta."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}