Capev2
Monthly
Missing task ownership verification in CAPEv2's REST API allows any authenticated user to enumerate, read, and delete malware analysis submissions belonging to other users. Affecting all CAPEv2 installations through commit 471ee4b, the flaw resides in the task view and delete endpoints within `web/apiv2/views.py`, where the API authenticates the caller but never checks whether the caller owns the requested task. No public exploit has been identified at time of analysis, but the low attack complexity and entirely network-accessible API surface make this trivially exploitable by any user with a valid account on a multi-tenant CAPEv2 instance.
Missing task ownership verification in CAPEv2's REST API allows any authenticated user to enumerate, read, and delete malware analysis submissions belonging to other users. Affecting all CAPEv2 installations through commit 471ee4b, the flaw resides in the task view and delete endpoints within `web/apiv2/views.py`, where the API authenticates the caller but never checks whether the caller owns the requested task. No public exploit has been identified at time of analysis, but the low attack complexity and entirely network-accessible API surface make this trivially exploitable by any user with a valid account on a multi-tenant CAPEv2 instance.