Vulnerability · Published Aug 11, 2026 · Assigned by VulnCheck

CVE-2026-69113Cap v0.3.1 Broken Access Control via video comment endpoint

Medium 5.4

In plain English

A medium-severity missing authorization in Cap from CapSoftware. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

Affected products (as reported)

Vendor	Product	Versions
CapSoftware	Cap	0 – through 0.3.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Product Repository product
GitHub Issue issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/cap-broken-access-control-via-video-comment-endpoint third-party-advisory