Vulnerability · Published Sep 13, 2026 · Assigned by VulnCheck
CVE-2026-90768CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check
High 8.1
In plain English
A high-severity missing authorization in CAPEv2 from kevoreilly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 62.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kevoreilly | CAPEv2 | 0 – through 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Issue #3162 issue-tracking
- https://github.com/kevoreilly/CAPEv2 product
- https://github.com/kevoreilly/CAPEv2/blob/1255b18/web/apiv2/views.py technical-description
- VulnCheck Advisory: CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check third-party-advisory