EUVD-2026-76989
GHSA-fvg9-xv37-6j7j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requiring only a low-privilege account; no confidentiality/integrity scope change beyond the task data store; no availability impact described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
AnalysisAI
Missing task ownership verification in CAPEv2's REST API allows any authenticated user to enumerate, read, and delete malware analysis submissions belonging to other users. Affecting all CAPEv2 installations through commit 471ee4b, the flaw resides in the task view and delete endpoints within web/apiv2/views.py, where the API authenticates the caller but never checks whether the caller owns the requested task. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated CAPEv2 user account with access to the REST API - any account, regardless of privilege level, is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately captures the risk profile: the attack is fully network-accessible, requires no special conditions or user interaction, demands only a low-privilege account, and yields both high confidentiality impact (read any analysis report, sample, behavioral log) and high integrity impact (delete any analysis). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a CAPEv2 commit beyond 471ee4b that includes ownership validation on the task view and delete API endpoints; monitor the upstream repository at https://github.com/kevoreilly/CAPEv2 and the associated GitHub issue https://github.com/kevoreilly/CAPEv2/issues/3162 for a confirmed fix commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network-level access to CAPEv2's REST API using firewall rules or VPN requirements, and audit API access logs for unauthorized task enumeration or deletion patterns across different user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today