Which versions of Cap are affected by CVE-2026-59704?

Cap's AI video endpoint contains an authorization vulnerability (CVE-2026-59704, CVSS 7.1) that allows any authenticated user to access private AI-generated metadata belonging to other users and…. A patch is available.

How to fix or mitigate CVE-2026-59704?

Within 24 hours: Assess exposure by identifying all users and services with API access to Cap's GET /api/video/ai endpoint; review access logs for requests referencing video IDs not owned by the requestor. Within 7 days: Deploy vendor patch (commit 8d48642) to all production Cap instances and confirm object-level authorization validation now correctly enforces ownership checks. Within 30 days: Conduct forensic review of API access logs for exploitation evidence (cross-user video ID access); notify affected users if unauthorized access is confirmed.

Cap CVE-2026-59704

Q: What is the CVSS score of CVE-2026-59704?

CVE-2026-59704 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42128 HIGH

Missing Authorization (CWE-862)

2026-07-07 VulnCheck

GHSA-2fr3-3757-j2f7

Authentication Bypass Cap

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network endpoint reachable by any authenticated user (PR:L, AV:N/AC:L/UI:N); high confidentiality from private metadata disclosure, low integrity from unauthorized AI generation, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 23:21 vuln.today

DescriptionCVE.org

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.

AnalysisAI

Broken object-level authorization in Cap's GET /api/video/ai endpoint lets any authenticated user supply arbitrary video IDs to read private AI-generated metadata - titles, summaries, and chapters - belonging to other users, and to trigger unauthorized AI generation that burns the victim's credits. Reported by VulnCheck with a vendor patch (commit 8d48642) available; no public exploit identified at time of analysis, and EPSS/KEV data were not supplied. The flaw combines confidentiality loss over private content with an abusable, cost-incurring side effect.

Technical ContextAI

Cap is an open-source screen recording and sharing platform (CapSoftware/Cap, CPE cpe:2.3:a:cap:cap). The vulnerable component is a web API route, GET /api/video/ai, that returns AI-derived metadata for a given video ID. The root cause is CWE-862 (Missing Authorization): the handler authenticates the caller but never checks whether that caller owns the requested video or belongs to a workspace/organization that shares it. Because the endpoint keys off an attacker-controllable video identifier without an ownership/membership predicate, it exposes an Insecure Direct Object Reference. A secondary effect is that requesting metadata for a video lacking cached AI output triggers on-demand generation, which is billed against the video owner's account.

RemediationAI

Patch available per vendor advisory: apply the upstream fix in commit 8d48642b6e7938af238386383ef1c273be4110dd (PR https://github.com/CapSoftware/Cap/pull/1926), which adds ownership/membership validation to GET /api/video/ai; an exact released/tagged version was not provided, so an upstream fix is available but a released patched version is not independently confirmed - self-hosters should rebuild from the patched commit or later. As a compensating control until patched, restrict access to the /api/video/ai route at a reverse proxy or API gateway (allowlist known service callers), or disable the AI-metadata feature if not essential - trade-off: this removes AI summary/chapter functionality for all users. To specifically curb credit abuse, rate-limit or gate the on-demand AI generation path and monitor for accounts requesting video IDs they do not own. See the VulnCheck advisory (https://www.vulncheck.com/advisories/cap-missing-access-control-in-video-ai-metadata-endpoint) and issue #1981 for details.