EUVD-2026-56853
GHSA-g8pr-hj3h-h4pm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable by any authenticated low-privilege user (PR:L); limited confidentiality (ID enumeration) and integrity (unauthorized comment injection) impacts with no availability or scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.
AnalysisAI
Broken access control in Cap v0.3.1's POST /api/video/comment endpoint allows any authenticated user to post comments on arbitrary private videos owned by other users by supplying an attacker-chosen videoId in the request body. Beyond unauthorized commenting, attackers can trigger notification emails to the video owner and enumerate valid private video IDs through response differences, constituting both a confidentiality and integrity breach. No public exploit code or CISA KEV listing has been identified at time of analysis, and the upstream fix has been committed to the Cap GitHub repository.
Technical ContextAI
Cap is an open-source screen recording and sharing platform (CapSoftware/Cap on GitHub). The affected endpoint POST /api/video/comment is a server action in apps/web/actions/videos/new-comment.ts. CWE-862 (Missing Authorization) is the root cause: the original code verified that the requesting user was authenticated but performed no authorization check to confirm whether that user had view or comment rights on the target video identified by the client-supplied videoId parameter. Because authentication and authorization were conflated, any authenticated session could inject into any video's comment thread. The patch, visible in commit 1b812d88958f784ee66d2eace60e731624832c9d, introduces a VideosPolicy authorization check using an Effect-based policy framework (provideOptionalAuth, VideosPolicy.canView), and also guards against a secondary design quirk where canView returned true for nonexistent video IDs, which would have allowed bogus IDs to reach the database insert. The fix explicitly fetches the video row and verifies policy before proceeding.
RemediationAI
An upstream fix has been committed at https://github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c9d; however, a specific tagged release version containing this patch has not been independently confirmed from the available data. Operators should update Cap to the latest commit from the main branch or await a formal release that includes this commit. As a compensating control prior to patching, administrators of self-hosted Cap instances can restrict access to the comment endpoint (POST /api/video/comment) at the network or reverse-proxy layer to only trusted user groups, accepting the trade-off that legitimate commenting functionality will be unavailable during the restriction window. Additionally, auditing existing comment activity on private videos for anomalous entries from non-owner accounts can help assess whether the vulnerability was exploited prior to patching. The GitHub issue tracking this is at https://github.com/CapSoftware/Cap/issues/1982.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today