CVE-2026-59704

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59704
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59704.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59704
Published
2026-07-07T22:18:48.724Z
Modified
2026-08-12T03:51:35.191425046Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Cap - Missing Access Control in Video AI Metadata Endpoint
Details

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "8d48642"
                }
            ]
        }
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59704.json"
}
References

Affected packages

Git / github.com/capsoftware/cap

Affected ranges

Type
GIT
Repo
https://github.com/capsoftware/cap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8d48642b6e7938af238386383ef1c273be4110dd
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

cap-v0.*
cap-v0.1.3
cap-v0.1.4
cap-v0.1.5
cap-v0.1.6
cap-v0.1.7
cap-v0.1.8
cap-v0.2.3
cap-v0.2.4
cap-v0.2.5
cap-v0.2.6
cap-v0.2.9
cap-v0.3.0-alpha.0
cap-v0.3.0-alpha.1
cap-v0.3.0-alpha.10
cap-v0.3.0-alpha.11
cap-v0.3.0-alpha.12
cap-v0.3.0-alpha.13
cap-v0.3.0-alpha.14
cap-v0.3.0-alpha.15
cap-v0.3.0-alpha.16
cap-v0.3.0-alpha.17
cap-v0.3.0-alpha.18
cap-v0.3.0-alpha.19
cap-v0.3.0-alpha.2
cap-v0.3.0-alpha.20
cap-v0.3.0-alpha.21
cap-v0.3.0-alpha.22
cap-v0.3.0-alpha.23
cap-v0.3.0-alpha.24
cap-v0.3.0-alpha.25
cap-v0.3.0-alpha.27
cap-v0.3.0-alpha.3
cap-v0.3.0-alpha.4
cap-v0.3.0-alpha.5
cap-v0.3.0-beta.2
cap-v0.3.0-beta.4
cap-v0.3.0-beta.5
cap-v0.3.0-beta.5.1
cap-v0.3.0-beta.5.2
cap-v0.3.0-beta.5.3
cap-v0.3.0-beta.5.4
cap-v0.3.0-beta.5.5
cap-v0.3.0-beta.5.6
cap-v0.3.0-beta.5.6.1
cap-v0.3.0-beta.5.7.1
cap-v0.3.0-beta.5.7.2
cap-v0.3.0-beta.5.7.3
cap-v0.3.0-beta.5.7.4
cap-v0.3.0-beta.5.8
cap-v0.3.0-beta.6
cap-v0.3.0-beta.7
cap-v0.3.0-beta.8
cap-v0.3.0-beta.9
cap-v0.3.0-beta.9.1
cap-v0.3.0-beta.9.2
cap-v0.3.1
cap-v0.3.1-alpha.25
cap-v0.3.1-alpha.26
cap-v0.3.10
cap-v0.3.11
cap-v0.3.12
cap-v0.3.13
cap-v0.3.14
cap-v0.3.15
cap-v0.3.16
cap-v0.3.17
cap-v0.3.18
cap-v0.3.19
cap-v0.3.20
cap-v0.3.21
cap-v0.3.22
cap-v0.3.23
cap-v0.3.24
cap-v0.3.25
cap-v0.3.26
cap-v0.3.28
cap-v0.3.29
cap-v0.3.30
cap-v0.3.31
cap-v0.3.32
cap-v0.3.33
cap-v0.3.34
cap-v0.3.35
cap-v0.3.36
cap-v0.3.37
cap-v0.3.38
cap-v0.3.39
cap-v0.3.40
cap-v0.3.41
cap-v0.3.42
cap-v0.3.43
cap-v0.3.44
cap-v0.3.45
cap-v0.3.46
cap-v0.3.47
cap-v0.3.48
cap-v0.3.49
cap-v0.3.50
cap-v0.3.51
cap-v0.3.52
cap-v0.3.55
cap-v0.3.56
cap-v0.3.57
cap-v0.3.58
cap-v0.3.60
cap-v0.3.62
cap-v0.3.63
cap-v0.3.64
cap-v0.3.65
cap-v0.3.66
cap-v0.3.67
cap-v0.3.68
cap-v0.3.69
cap-v0.3.70
cap-v0.3.71
cap-v0.3.72
cap-v0.3.72-beta.1
cap-v0.3.73
cap-v0.3.74
cap-v0.3.75
cap-v0.3.76
cap-v0.3.77
cap-v0.3.78
cap-v0.3.79
cap-v0.3.80
cap-v0.3.81
cap-v0.3.83
cap-v0.3.84
cap-v0.4.0
cap-v0.4.1
cap-v0.4.2
cap-v0.4.3
cap-v0.4.4
cap-v0.4.5
cap-v0.4.6
cap-v0.4.7
cap-v0.4.71
cap-v0.4.8
cap-v0.4.81
cap-v0.4.82
cap-v0.4.83
cap-v0.4.84
cap-v0.4.85
cap-v0.4.86
cap-v0.4.87
cap-v0.5.0
cap-v0.5.1
Other
untagged-e11fa29aaf3da04ee617

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59704.json"