CVE-2026-69113

Name of the Vulnerable Software and Affected Versions Cap version 0.3.1

Description Broken access control in the 'POST /api/video/comment' endpoint allows authenticated users to post comments on private videos without authorization. By providing an arbitrary videoId in the request body, an attacker can inject comments into private recordings of other users, trigger notification emails to the video owner, and enumerate valid video IDs by analyzing differences in the server responses.

Recommendations Update Cap to a version newer than 0.3.1. As a temporary mitigation, restrict access to the 'POST /api/video/comment' endpoint or validate that the authenticated user has permission to access the specified videoId before processing the comment.