CVE-2026-69113
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Cap version 0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.
Risk Assessment
An attacker can violate user privacy by adding unwanted comments to private videos, potentially leading to information disclosure or harassment. They can also enumerate video IDs, facilitating further attacks.
Recommendation
Update Cap to a version that fixes this vulnerability, or implement proper access control on the server to verify video permissions before allowing comments.
Original NVD description (English source)
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.