---
id: CVE-2026-90768
title: >-
  CAPEv2 through commit 471ee4b fails to validate task ownership in REST API
  endpoints, allowing authenticated users to read and delete analyses submitted
  by other users
summary: >-
  CAPEv2 through commit 471ee4b fails to validate task ownership in REST API
  endpoints, allowing authenticated users to read and delete analyses submitted
  by other users. Attackers can enumerate all tasks in the system and delete
  arbitrary…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-862
vendor: kevoreilly
product: CAPEv2
affected:
  - CAPEv2 <= 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0
published: '2026-09-13'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:47.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90768'
references:
  - url: 'https://github.com/kevoreilly/CAPEv2'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/kevoreilly/CAPEv2/blob/1255b18/web/apiv2/views.py'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/kevoreilly/CAPEv2/issues/3162'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/capev2-through-commit-471ee4b-rest-api-task-endpoints-missing-ownership-check
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00243
epssPercentile: 0.15827
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T16:14:35.710307Z'
ingestedAt: '2026-09-14T15:23:07.471Z'
---

## Overview

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.