Threats affecting pkg:github/Cap

CVE-2026-59704 is a vulnerability in Cap's GET /api/video/ai endpoint where the system fails to verify user ownership or membership before disclosing private AI-generated video metadata. Authenticated attackers can access sensitive content such as titles, summaries, and chapters of videos they do not own. Additionally, attackers can trigger unauthorized AI generation that consumes the video owner's credits without their consent.