Vulnerability Description
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/CapSoftware/Cap
- https://github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c
- https://github.com/CapSoftware/Cap/issues/1982
- https://www.vulncheck.com/advisories/cap-broken-access-control-via-video-comment
- https://github.com/CapSoftware/Cap/issues/1982
FAQ
What is CVE-2026-69113?
CVE-2026-69113 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying ...
How severe is CVE-2026-69113?
CVE-2026-69113 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-69113?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.