CVE-2026-59704

HighCVSS 7.1

Published: 07/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The GET /api/video/ai endpoint in Cap fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.

Risk Assessment

The organization faces exposure of confidential AI metadata and uncontrolled resource consumption (credits), potentially leading to financial losses and privacy breaches.

Recommendation

Immediately implement ownership or membership validation for the GET /api/video/ai endpoint to ensure that the authenticated user is authorized to access the metadata of the specified video.

Other vulnerabilities in Cap

CVE-2026-69113Medium
Cap version 0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

Original NVD description (English source)

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.