CVE-2026-90768

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90768

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90768.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90768

Published

2026-09-13T10:45:39Z

Modified

2026-10-08T02:53:18Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

Details

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90768.json"
}

References

Affected packages

Git / github.com/kevoreilly/capev2

Affected ranges

Type: GIT
Repo: https://github.com/kevoreilly/capev2
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last Affected

471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90768.json"