Cap's AI Video Metadata Exposure via IDOR

Executive Summary

This vulnerability exists in Cap's GET /api/video/ai endpoint, which fails to verify whether a user owns or is a member authorized to access certain video AI metadata. As a result, authenticated attackers can provide arbitrary video IDs to access private AI-generated content such as titles, summaries, and chapters that they should not see.

Additionally, attackers can trigger unauthorized AI generation processes that consume the video owner's credits without their consent.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive AI-generated video metadata, compromising privacy and confidentiality.

It can also result in financial impact or resource misuse, as attackers can trigger AI generation that consumes the video owner's credits without permission.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated attackers to access private video AI metadata without proper validation of user ownership or membership. This unauthorized access to sensitive AI-generated content could lead to exposure of personal or confidential information.

Such unauthorized disclosure of sensitive data may result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Additionally, the unauthorized triggering of AI generation consuming the video owner's credits without consent may raise concerns about consent and resource misuse under these regulations.

Useful 0 Not Useful 0