CAPEv2 Task Ownership Validation Bypass Leads to Unauthorized Data Access

Executive Summary

CVE-2026-90768 is a high-severity vulnerability in CAPEv2 through commit 471ee4b where REST API task endpoints lack ownership checks. Authenticated users can read or delete analyses submitted by other users by exploiting endpoints for viewing, listing, and deleting tasks without verifying ownership. This is classified under CWE-862 (Missing Authorization).

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-90768, check CAPEv2 REST API endpoints for unauthorized access to tasks. Monitor logs for requests to /apiv2/tasks/view/{task_id}/, /apiv2/tasks/list/, /apiv2/tasks/delete/{task_id}/, or /analysis/remove/{task_id}/ from unexpected users. Verify if task ownership checks are missing by testing if userB can access userA's tasks.

Useful 0 Not Useful 0

Impact Analysis

Attackers with valid credentials can enumerate all tasks in the system and delete arbitrary analyses. This could lead to loss of critical malware analysis data, unauthorized access to sensitive task information, and disruption of malware research operations. The impact is higher if the system handles sensitive or proprietary malware samples.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate data integrity, access controls, and auditability. GDPR requires protecting personal data, and unauthorized deletion or access to task data may breach these obligations. HIPAA requires safeguarding protected health information, which could be compromised if malware analysis tasks contain such data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update CAPEv2 to a version beyond commit 471ee4b. Implement ownership validation in task-related API endpoints by ensuring functions like db.view_task() and db.list_tasks() compare task.user_id with request.user.id. Restrict access to staff users if mismatched. Disable web_auth and token_auth if not required.

Useful 0 Not Useful 0