Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-69113— Cap v0.3.1 Broken Access Control via video comment endpoint

Quick assessment

Affected
CapSoftware Cap
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cap是Cap组织开源的一款支持屏幕录制、本地编辑、即时链接分享和自托管的跨平台视频协作工具。 Cap 0.3.1版本存在授权问题漏洞，该漏洞源于/API/video/comment端点存在访问控制失效，允许已认证用户通过请求体中的任意videoId对私有视频发表评论，可能导致攻击者向其他用户私有视频注入评论、触发通知邮件并枚举有效视频ID。

CVSS 5.4 · Medium EPSS 0.27% · P18

Affected Version Matrix 1

VendorProduct Version RangeStatus
CapSoftware Cap ≤ 0.3.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-69113

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cap v0.3.1 Broken Access Control via video comment endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Cap 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cap是Cap组织开源的一款支持屏幕录制、本地编辑、即时链接分享和自托管的跨平台视频协作工具。 Cap 0.3.1版本存在授权问题漏洞，该漏洞源于/API/video/comment端点存在访问控制失效，允许已认证用户通过请求体中的任意videoId对私有视频发表评论，可能导致攻击者向其他用户私有视频注入评论、触发通知邮件并枚举有效视频ID。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
CapSoftware Cap 0 ~ 0.3.1 -

II. Public POCs for CVE-2026-69113

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-69113

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-69113 (1)

Vendor Advisories for CVE-2026-69113 (1)

Other References for CVE-2026-69113 (1)

IV. Related Vulnerabilities

Same product: Cap
Same weakness: CWE-862

V. Comments for CVE-2026-69113

No comments yet

Leave a comment