What’s Vulnerable › Vulnerabilities

CVE-2026-59704: Cap - Missing Access Control in Video AI Metadata Endpoint

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-10-08
• Weakness: CWE-862

Description

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.

Affected products

• Cap: through 8d48642

References

• https://github.com/CapSoftware/Cap
• https://github.com/CapSoftware/Cap/commit/8d48642b6e7938af238386383ef1c273be4110dd
• https://github.com/CapSoftware/Cap/issues/1981
• https://github.com/CapSoftware/Cap/pull/1926
• https://www.vulncheck.com/advisories/cap-missing-access-control-in-video-ai-metadata-endpoint
• https://github.com/CapSoftware/Cap/issues/1981

Get alerted when CVE-2026-59704 or the next vulnerability affects your stack