{"id":"CVE-2026-59704","summary":"Cap - Missing Access Control in Video AI Metadata Endpoint","details":"Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.","modified":"2026-08-12T03:51:35.191425046Z","published":"2026-07-07T22:18:48.724Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59704.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"last_affected":"8d48642"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59704.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59704"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/cap-missing-access-control-in-video-ai-metadata-endpoint"},{"type":"REPORT","url":"https://github.com/CapSoftware/Cap/issues/1981"},{"type":"REPORT","url":"https://github.com/CapSoftware/Cap/pull/1926"},{"type":"FIX","url":"https://github.com/CapSoftware/Cap/commit/8d48642b6e7938af238386383ef1c273be4110dd"},{"type":"PACKAGE","url":"https://github.com/CapSoftware/Cap"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/capsoftware/cap","events":[{"introduced":"0"},{"fixed":"8d48642b6e7938af238386383ef1c273be4110dd"}],"database_specific":{"source":"REFERENCES"}}],"versions":["cap-v0.5.1","cap-v0.5.0","cap-v0.4.87","cap-v0.4.86","cap-v0.4.85","cap-v0.4.84","cap-v0.4.83","cap-v0.4.82","cap-v0.4.81","cap-v0.4.8","cap-v0.4.71","cap-v0.4.7","cap-v0.4.6","cap-v0.4.5","cap-v0.4.4","cap-v0.4.3","cap-v0.4.2","untagged-e11fa29aaf3da04ee617","cap-v0.4.1","cap-v0.4.0","cap-v0.3.84","cap-v0.3.83","cap-v0.3.81","cap-v0.3.80","cap-v0.3.79","cap-v0.3.78","cap-v0.3.77","cap-v0.3.76","cap-v0.3.75","cap-v0.3.74","cap-v0.3.73","cap-v0.3.72","cap-v0.3.72-beta.1","cap-v0.3.71","cap-v0.3.70","cap-v0.3.69","cap-v0.3.68","cap-v0.3.67","cap-v0.3.66","cap-v0.3.65","cap-v0.3.64","cap-v0.3.63","cap-v0.3.62","cap-v0.3.60","cap-v0.3.58","cap-v0.3.57","cap-v0.3.56","cap-v0.3.55","cap-v0.3.52","cap-v0.3.51","cap-v0.3.50","cap-v0.3.49","cap-v0.3.48","cap-v0.3.47","cap-v0.3.46","cap-v0.3.45","cap-v0.3.44","cap-v0.3.43","cap-v0.3.42","cap-v0.3.41","cap-v0.3.40","cap-v0.3.39","cap-v0.3.38","cap-v0.3.37","cap-v0.3.36","cap-v0.3.35","cap-v0.3.34","cap-v0.3.33","cap-v0.3.32","cap-v0.3.31","cap-v0.3.30","cap-v0.3.29","cap-v0.3.28","cap-v0.3.26","cap-v0.3.25","cap-v0.3.24","cap-v0.3.23","cap-v0.3.22","cap-v0.3.21","cap-v0.3.20","cap-v0.3.19","cap-v0.3.18","cap-v0.3.17","cap-v0.3.16","cap-v0.3.15","cap-v0.3.14","cap-v0.3.13","cap-v0.3.12","cap-v0.3.11","cap-v0.3.10","cap-v0.3.1-alpha.26","cap-v0.3.1-alpha.25","cap-v0.3.1","cap-v0.3.0-beta.9.2","cap-v0.3.0-beta.9.1","cap-v0.3.0-beta.9","cap-v0.3.0-beta.8","cap-v0.3.0-beta.7","cap-v0.3.0-beta.6","cap-v0.3.0-beta.5.8","cap-v0.3.0-beta.5.7.4","cap-v0.3.0-beta.5.7.3","cap-v0.3.0-beta.5.7.2","cap-v0.3.0-beta.5.7.1","cap-v0.3.0-beta.5.6.1","cap-v0.3.0-beta.5.6","cap-v0.3.0-beta.5.5","cap-v0.3.0-beta.5.4","cap-v0.3.0-beta.5.3","cap-v0.3.0-beta.5.2","cap-v0.3.0-beta.5.1","cap-v0.3.0-beta.5","cap-v0.3.0-beta.4","cap-v0.3.0-beta.2","cap-v0.3.0-alpha.27","cap-v0.3.0-alpha.25","cap-v0.3.0-alpha.24","cap-v0.3.0-alpha.23","cap-v0.3.0-alpha.22","cap-v0.3.0-alpha.21","cap-v0.3.0-alpha.20","cap-v0.3.0-alpha.19","cap-v0.3.0-alpha.18","cap-v0.3.0-alpha.17","cap-v0.3.0-alpha.16","cap-v0.3.0-alpha.15","cap-v0.3.0-alpha.14","cap-v0.3.0-alpha.13","cap-v0.3.0-alpha.12","cap-v0.3.0-alpha.11","cap-v0.3.0-alpha.10","cap-v0.3.0-alpha.5","cap-v0.3.0-alpha.4","cap-v0.3.0-alpha.3","cap-v0.3.0-alpha.2","cap-v0.3.0-alpha.1","cap-v0.3.0-alpha.0","cap-v0.2.9","cap-v0.2.6","cap-v0.2.5","cap-v0.2.4","cap-v0.2.3","cap-v0.1.8","cap-v0.1.7","cap-v0.1.6","cap-v0.1.5","cap-v0.1.4","cap-v0.1.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59704.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}