High severity8.1NVD Advisory· Published Sep 13, 2026

CVE-2026-90768

Description

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

Affected products

Kevoreilly/Capev2references2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=471ee4b

Patches

Vulnerability mechanics

References

github.com/kevoreilly/CAPEv2/blob/1255b18/web/apiv2/views.pynvd
github.com/kevoreilly/CAPEv2/issues/3162nvd
www.vulncheck.com/advisories/capev2-through-commit-471ee4b-rest-api-task-endpoints-missing-ownership-checknvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000