REST API Vulnerability in CAPEv2 by Kevin O'Reilly
CVE-2026-90768

8.6HIGH

Key Information:

Vendor

Kevoreilly

Status
Capev2
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90768?

CAPEv2, in versions prior to commit 471ee4b, contains a vulnerability in its REST API endpoints that fails to properly validate task ownership. This flaw permits authenticated users to access, read, and delete analyses submitted by other users. Consequently, attackers can exploit this weakness to enumerate all tasks within the system and manipulate analyses without appropriate permissions, potentially leading to unauthorized data exposure and loss.

Affected Version(s)

CAPEv2 0 <= 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0

References

https://github.com/kevoreilly/CAPEv2/issues/3162
issue-tracking
https://github.com/kevoreilly/CAPEv2
product
https://github.com/kevoreilly/CAPEv2/blob/1255b18/web/api...
technical-description

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.