{"id":"CVE-2026-69113","summary":"Cap v0.3.1 Broken Access Control via video comment endpoint","details":"Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.","modified":"2026-08-16T03:31:31.681958642Z","published":"2026-08-11T18:13:39.653Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69113.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69113.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69113"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/cap-broken-access-control-via-video-comment-endpoint"},{"type":"REPORT","url":"https://github.com/CapSoftware/Cap/issues/1982"},{"type":"FIX","url":"https://github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c9d"},{"type":"PACKAGE","url":"https://github.com/CapSoftware/Cap"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/capsoftware/cap","events":[{"introduced":"0"},{"fixed":"1b812d88958f784ee66d2eace60e731624832c9d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.3.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["cap-nightly-v0.5.8-nightly.202607290403","cap-v0.5.7","cap-nightly-v0.5.7-nightly.202607170401","cap-nightly-v0.5.7-nightly.202607130414","cap-v0.5.6","cap-nightly-v0.5.7-nightly.202607090421","cap-nightly-v0.5.6-nightly.202607080404","cap-nightly-v0.5.6-nightly.202607071602","cap-v0.5.5","cap-nightly-v0.5.6-nightly.202607070759","cap-v0.5.4","cap-v0.5.2","cap-v0.5.1","cap-v0.5.0","cap-v0.4.87","cap-v0.4.86","cap-v0.4.85","cap-v0.4.84","cap-v0.4.83","cap-v0.4.82","cap-v0.4.81","cap-v0.4.8","cap-v0.4.71","cap-v0.4.7","cap-v0.4.6","cap-v0.4.5","cap-v0.4.4","cap-v0.4.3","cap-v0.4.2","untagged-e11fa29aaf3da04ee617","cap-v0.4.1","cap-v0.4.0","cap-v0.3.84","cap-v0.3.83","cap-v0.3.81","cap-v0.3.80","cap-v0.3.79","cap-v0.3.78","cap-v0.3.77","cap-v0.3.76","cap-v0.3.75","cap-v0.3.74","cap-v0.3.73","cap-v0.3.72","cap-v0.3.72-beta.1","cap-v0.3.71","cap-v0.3.70","cap-v0.3.69","cap-v0.3.68","cap-v0.3.67","cap-v0.3.66","cap-v0.3.65","cap-v0.3.64","cap-v0.3.63","cap-v0.3.62","cap-v0.3.60","cap-v0.3.58","cap-v0.3.57","cap-v0.3.56","cap-v0.3.55","cap-v0.3.52","cap-v0.3.51","cap-v0.3.50","cap-v0.3.49","cap-v0.3.48","cap-v0.3.47","cap-v0.3.46","cap-v0.3.45","cap-v0.3.44","cap-v0.3.43","cap-v0.3.42","cap-v0.3.41","cap-v0.3.40","cap-v0.3.39","cap-v0.3.38","cap-v0.3.37","cap-v0.3.36","cap-v0.3.35","cap-v0.3.34","cap-v0.3.33","cap-v0.3.32","cap-v0.3.31","cap-v0.3.30","cap-v0.3.29","cap-v0.3.28","cap-v0.3.26","cap-v0.3.25","cap-v0.3.24","cap-v0.3.23","cap-v0.3.22","cap-v0.3.21","cap-v0.3.20","cap-v0.3.19","cap-v0.3.18","cap-v0.3.17","cap-v0.3.16","cap-v0.3.15","cap-v0.3.14","cap-v0.3.13","cap-v0.3.12","cap-v0.3.11","cap-v0.3.10","cap-v0.3.1-alpha.26","cap-v0.3.1-alpha.25","cap-v0.3.1","cap-v0.3.0-beta.9.2","cap-v0.3.0-beta.9.1","cap-v0.3.0-beta.9","cap-v0.3.0-beta.8","cap-v0.3.0-beta.7","cap-v0.3.0-beta.6","cap-v0.3.0-beta.5.8","cap-v0.3.0-beta.5.7.4","cap-v0.3.0-beta.5.7.3","cap-v0.3.0-beta.5.7.2","cap-v0.3.0-beta.5.7.1","cap-v0.3.0-beta.5.6.1","cap-v0.3.0-beta.5.6","cap-v0.3.0-beta.5.5","cap-v0.3.0-beta.5.4","cap-v0.3.0-beta.5.3","cap-v0.3.0-beta.5.2","cap-v0.3.0-beta.5.1","cap-v0.3.0-beta.5","cap-v0.3.0-beta.4","cap-v0.3.0-beta.2","cap-v0.3.0-alpha.27","cap-v0.3.0-alpha.25","cap-v0.3.0-alpha.24","cap-v0.3.0-alpha.23","cap-v0.3.0-alpha.22","cap-v0.3.0-alpha.21","cap-v0.3.0-alpha.20","cap-v0.3.0-alpha.19","cap-v0.3.0-alpha.18","cap-v0.3.0-alpha.17","cap-v0.3.0-alpha.16","cap-v0.3.0-alpha.15","cap-v0.3.0-alpha.14","cap-v0.3.0-alpha.13","cap-v0.3.0-alpha.12","cap-v0.3.0-alpha.11","cap-v0.3.0-alpha.10","cap-v0.3.0-alpha.5","cap-v0.3.0-alpha.4","cap-v0.3.0-alpha.3","cap-v0.3.0-alpha.2","cap-v0.3.0-alpha.1","cap-v0.3.0-alpha.0","cap-v0.2.9","cap-v0.2.6","cap-v0.2.5","cap-v0.2.4","cap-v0.2.3","cap-v0.1.8","cap-v0.1.7","cap-v0.1.6","cap-v0.1.5","cap-v0.1.4","cap-v0.1.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69113.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}