---
id: CVE-2026-69113
title: >-
  Cap v0.3.1 contains a broken access control vulnerability in the POST
  /api/video/comment endpoint that allows authenticated users to post comments
  on any private video without permission by supplying an arbitrary videoId in
  the request b…
summary: >-
  Cap v0.3.1 contains a broken access control vulnerability in the POST
  /api/video/comment endpoint that allows authenticated users to post comments
  on any private video without permission by supplying an arbitrary videoId in
  the request b…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-862
published: '2026-08-11'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69113'
references:
  - url: 'https://github.com/CapSoftware/Cap'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/CapSoftware/Cap/commit/1b812d88958f784ee66d2eace60e731624832c9d
    label: disclosure@vulncheck.com
  - url: 'https://github.com/CapSoftware/Cap/issues/1982'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cap-broken-access-control-via-video-comment-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://github.com/CapSoftware/Cap/issues/1982'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00304
epssPercentile: 0.20573
ingestedAt: '2026-09-24T20:51:40.191Z'
---

## Overview

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.