CVE-2026-69113

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69113
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69113.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-69113
Published
2026-08-11T18:13:39.653Z
Modified
2026-08-16T03:31:31.681958642Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Cap v0.3.1 Broken Access Control via video comment endpoint
Details

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69113.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/capsoftware/cap

Affected ranges

Type
GIT
Repo
https://github.com/capsoftware/cap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1b812d88958f784ee66d2eace60e731624832c9d
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.3.1"
        }
    ]
}

Affected versions

cap-nightly-v0.*
cap-nightly-v0.5.6-nightly.202607070759
cap-nightly-v0.5.6-nightly.202607071602
cap-nightly-v0.5.6-nightly.202607080404
cap-nightly-v0.5.7-nightly.202607090421
cap-nightly-v0.5.7-nightly.202607130414
cap-nightly-v0.5.7-nightly.202607170401
cap-nightly-v0.5.8-nightly.202607290403
cap-v0.*
cap-v0.1.3
cap-v0.1.4
cap-v0.1.5
cap-v0.1.6
cap-v0.1.7
cap-v0.1.8
cap-v0.2.3
cap-v0.2.4
cap-v0.2.5
cap-v0.2.6
cap-v0.2.9
cap-v0.3.0-alpha.0
cap-v0.3.0-alpha.1
cap-v0.3.0-alpha.10
cap-v0.3.0-alpha.11
cap-v0.3.0-alpha.12
cap-v0.3.0-alpha.13
cap-v0.3.0-alpha.14
cap-v0.3.0-alpha.15
cap-v0.3.0-alpha.16
cap-v0.3.0-alpha.17
cap-v0.3.0-alpha.18
cap-v0.3.0-alpha.19
cap-v0.3.0-alpha.2
cap-v0.3.0-alpha.20
cap-v0.3.0-alpha.21
cap-v0.3.0-alpha.22
cap-v0.3.0-alpha.23
cap-v0.3.0-alpha.24
cap-v0.3.0-alpha.25
cap-v0.3.0-alpha.27
cap-v0.3.0-alpha.3
cap-v0.3.0-alpha.4
cap-v0.3.0-alpha.5
cap-v0.3.0-beta.2
cap-v0.3.0-beta.4
cap-v0.3.0-beta.5
cap-v0.3.0-beta.5.1
cap-v0.3.0-beta.5.2
cap-v0.3.0-beta.5.3
cap-v0.3.0-beta.5.4
cap-v0.3.0-beta.5.5
cap-v0.3.0-beta.5.6
cap-v0.3.0-beta.5.6.1
cap-v0.3.0-beta.5.7.1
cap-v0.3.0-beta.5.7.2
cap-v0.3.0-beta.5.7.3
cap-v0.3.0-beta.5.7.4
cap-v0.3.0-beta.5.8
cap-v0.3.0-beta.6
cap-v0.3.0-beta.7
cap-v0.3.0-beta.8
cap-v0.3.0-beta.9
cap-v0.3.0-beta.9.1
cap-v0.3.0-beta.9.2
cap-v0.3.1
cap-v0.3.1-alpha.25
cap-v0.3.1-alpha.26
cap-v0.3.10
cap-v0.3.11
cap-v0.3.12
cap-v0.3.13
cap-v0.3.14
cap-v0.3.15
cap-v0.3.16
cap-v0.3.17
cap-v0.3.18
cap-v0.3.19
cap-v0.3.20
cap-v0.3.21
cap-v0.3.22
cap-v0.3.23
cap-v0.3.24
cap-v0.3.25
cap-v0.3.26
cap-v0.3.28
cap-v0.3.29
cap-v0.3.30
cap-v0.3.31
cap-v0.3.32
cap-v0.3.33
cap-v0.3.34
cap-v0.3.35
cap-v0.3.36
cap-v0.3.37
cap-v0.3.38
cap-v0.3.39
cap-v0.3.40
cap-v0.3.41
cap-v0.3.42
cap-v0.3.43
cap-v0.3.44
cap-v0.3.45
cap-v0.3.46
cap-v0.3.47
cap-v0.3.48
cap-v0.3.49
cap-v0.3.50
cap-v0.3.51
cap-v0.3.52
cap-v0.3.55
cap-v0.3.56
cap-v0.3.57
cap-v0.3.58
cap-v0.3.60
cap-v0.3.62
cap-v0.3.63
cap-v0.3.64
cap-v0.3.65
cap-v0.3.66
cap-v0.3.67
cap-v0.3.68
cap-v0.3.69
cap-v0.3.70
cap-v0.3.71
cap-v0.3.72
cap-v0.3.72-beta.1
cap-v0.3.73
cap-v0.3.74
cap-v0.3.75
cap-v0.3.76
cap-v0.3.77
cap-v0.3.78
cap-v0.3.79
cap-v0.3.80
cap-v0.3.81
cap-v0.3.83
cap-v0.3.84
cap-v0.4.0
cap-v0.4.1
cap-v0.4.2
cap-v0.4.3
cap-v0.4.4
cap-v0.4.5
cap-v0.4.6
cap-v0.4.7
cap-v0.4.71
cap-v0.4.8
cap-v0.4.81
cap-v0.4.82
cap-v0.4.83
cap-v0.4.84
cap-v0.4.85
cap-v0.4.86
cap-v0.4.87
cap-v0.5.0
cap-v0.5.1
cap-v0.5.2
cap-v0.5.4
cap-v0.5.5
cap-v0.5.6
cap-v0.5.7
Other
untagged-e11fa29aaf3da04ee617

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69113.json"