CVE-2026-69113

Medium

Description

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

SeverityMedium

CVSS5.4

Exploit probability—

ProductCap

PublishedAug 11, 2026

First seenAug 11, 2026

Weakness typeCWE-862Missing authorization

How to fix

Patches

github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c9d

Affected products

Product	Affected versions	Fixed in
CapSoftware Cap	v ≤ 0.3.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.