CVE-2026-69113 describes a broken access control vulnerability in CapSoftware's Cap product version 0.3.1. The flaw exists in the POST /api/video/comment endpoint, where authenticated users can bypass authorization controls by supplying arbitrary video IDs in the request body. This enables unauthorized commenting on private videos, notification email triggers to video owners, and enumeration of valid video IDs through response analysis. No official remediation or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

Attackers with valid authentication can post comments on private videos they do not own, potentially leading to privacy violations and unwanted notifications to video owners. Additionally, the ability to enumerate valid video IDs may aid further targeted attacks or information gathering. There is no indication of privilege escalation or direct data exfiltration beyond comment injection and enumeration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the POST /api/video/comment endpoint to only authorized users and consider monitoring for unusual comment activity. Implement additional access control checks on the server side to verify user permissions for commenting on private videos.