CVE-2026-90768: Missing Authorization in kevoreilly CAPEv2
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
AI Analysis
Technical Summary
CAPEv2 through commit 471ee4b contains a missing authorization vulnerability in its REST API. The application does not validate whether the authenticated user owns the task when accessing task view and delete endpoints. Consequently, any authenticated user can enumerate all tasks in the system and delete analyses belonging to other users without proper ownership verification. This issue is tracked as CVE-2026-90768 with a CVSS 4.0 score of 8.6, indicating high severity.
Potential Impact
Authenticated users can access and delete analyses submitted by other users due to missing ownership validation. This can lead to unauthorized data exposure and loss of analysis data within the CAPEv2 system. The vulnerability compromises data integrity and confidentiality for affected users.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the CAPEv2 REST API to trusted users only and monitor for suspicious activity related to task enumeration or deletion.
CVE-2026-90768: Missing Authorization in kevoreilly CAPEv2
Description
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
CVSS v4.0
Score 8.6high
Affected software
kevoreilly
CAPEv2
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CAPEv2 through commit 471ee4b contains a missing authorization vulnerability in its REST API. The application does not validate whether the authenticated user owns the task when accessing task view and delete endpoints. Consequently, any authenticated user can enumerate all tasks in the system and delete analyses belonging to other users without proper ownership verification. This issue is tracked as CVE-2026-90768 with a CVSS 4.0 score of 8.6, indicating high severity.
Potential Impact
Authenticated users can access and delete analyses submitted by other users due to missing ownership validation. This can lead to unauthorized data exposure and loss of analysis data within the CAPEv2 system. The vulnerability compromises data integrity and confidentiality for affected users.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the CAPEv2 REST API to trusted users only and monitor for suspicious activity related to task enumeration or deletion.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-13T10:14:52.108Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa682ac55bf5e2cf583e18b
Added to database: 09/13/2026, 11:02:04 UTC
Last enriched: 09/13/2026, 11:16:55 UTC
Last updated: 09/14/2026, 03:06:46 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.