CVE-2026-90768: CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

Q: What level of access does an attacker need?

The attacker needs an authenticated CAPEv2 account. No elevated role or ownership of the targeted task is required.

Q: Which API functions should be treated as exposed?

The affected functionality includes REST API task-view and task-delete endpoints. Authenticated users can enumerate tasks and target analyses submitted by other users.

Q: What actions can an unauthorized user perform against another user's analysis?

They can read analyses and delete arbitrary analyses belonging to other users. The provided information does not describe other unauthorized modification capabilities.

Published Sep 13, 2026

Updated

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

Affected Software

1 affected component

CAPEv2>=<=471ee4b

Event History

Sep 13, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker needs an authenticated CAPEv2 account. No elevated role or ownership of the targeted task is required.

Which API functions should be treated as exposed?

The affected functionality includes REST API task-view and task-delete endpoints. Authenticated users can enumerate tasks and target analyses submitted by other users.

What actions can an unauthorized user perform against another user's analysis?

They can read analyses and delete arbitrary analyses belonging to other users. The provided information does not describe other unauthorized modification capabilities.

CVE-2026-90768: CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

Which API functions should be treated as exposed?

What actions can an unauthorized user perform against another user's analysis?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Which API functions should be treated as exposed?

What actions can an unauthorized user perform against another user's analysis?