CVE-2026-69113

Received Received - Intake

Authenticated Comment Injection in Cap Video Platform

Publication date: 2026-08-11

Last updated on: 2026-08-14

Assigner: VulnCheck

Description

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-14

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-69113

EUVD

EUVD-2026-56853

Affected Vendors & Products

Vendor	Product	Version / Range
capsoftware	cap	to 0.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-69113 is a broken access control vulnerability in Cap v0.3.1 affecting the POST /api/video/comment endpoint. It allows authenticated users to post comments on any private video by supplying an arbitrary videoId in the request body, even without proper permissions. This flaw enables attackers to inject comments into private videos, trigger notification emails to video owners, and enumerate valid video IDs through response differences.

Detection Guidance

To detect this vulnerability, monitor POST requests to /api/video/comment with arbitrary videoId values from authenticated users. Check for comments on private videos from users without ownership or access permissions. Look for unusual comment notification emails triggered by unauthorized users.

Impact Analysis

If you use Cap v0.3.1, an attacker with an account could post unauthorized comments on your private videos, spam you with comment notification emails, or guess valid video IDs by observing responses. Your private content could be exposed if videos become public later, and attackers may abuse notification systems.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR or HIPAA by exposing private video content to unauthorized users. It may lead to unauthorized data access, breaches of confidentiality, and failure to protect user data, potentially resulting in legal penalties or compliance violations.

Mitigation Strategies

Apply the patch from commit 1b812d88958f784ee66d2eace60e731624832c9d. Ensure the POST /api/video/comment endpoint verifies user permissions using VideosPolicy.canView before allowing comments. Update to Cap versions beyond 0.3.1.

Hi! I’m here to help you understand CVE-2026-69113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70