The vulnerability identified as CVE-2026-59704 affects the /api/video/ai endpoint of the Cap platform. This endpoint fails to verify whether the requesting user owns or is a member authorized to access the requested video. As a result, authenticated attackers can retrieve private AI-generated metadata for arbitrary videos by supplying arbitrary video IDs. Furthermore, attackers can initiate AI generation processes that consume the legitimate video owner's credits without authorization. This issue is categorized under CWE-862 (Missing Authorization). No patch or official remediation has been provided, and the service is not cloud-hosted, so remediation responsibility lies with the vendor.

Unauthorized disclosure of private AI-generated video metadata including titles, summaries, and chapters. Unauthorized consumption of video owner's AI generation credits, potentially leading to financial or resource loss for the owner. The vulnerability allows authenticated attackers to access and manipulate data without proper authorization checks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/video/ai endpoint to only trusted users and monitor for suspicious activity related to AI generation credit usage. Implement additional authorization checks to ensure users can only access metadata for videos they own or are authorized to view.