CVE-2026-59704 — Cap - Missing Access Control in Video AI Metadata Endpoint
Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticat…
Published: 2026-07-07 · CVSS: 7.1 · CVSS 4.0
Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7