What is CVE-2026-59704?

CVE-2026-59704 is a high-severity vulnerability in Cap, classified under Missing Authorization. CVSS score: 7.1/10. Published 2026-07-07.

How severe is CVE-2026-59704?

High severity. CVSS v3 base score is 7.1 out of 10.

Auth bypass in Cap

CVE-2026-59704

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive…

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

Affected products

Cap — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-59704?: CVE-2026-59704 is a high-severity vulnerability in Cap, classified under Missing Authorization. CVSS score: 7.1/10. Published 2026-07-07.
How severe is CVE-2026-59704?: High severity. CVSS v3 base score is 7.1 out of 10.