CVE-2026-90768
High
Description
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
SeverityHigh
CVSS8.1
Exploit probability—
ProductCAPEv2
PublishedSep 13, 2026
First seenSep 13, 2026
Weakness typeCWE-862Missing authorization
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kevoreilly CAPEv2 | v ≤ 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.