CVE-2026-59704: Cap API Authentication Bypass Vulnerability

CVE-2026-59704 Overview

CVE-2026-59704 is a missing authorization vulnerability [CWE-862] in Cap, an open-source screen recording platform maintained by CapSoftware. The GET /api/video/ai endpoint fails to verify whether the authenticated caller owns the requested video or belongs to a shared workspace. Any logged-in user can supply arbitrary video IDs and retrieve AI-generated metadata, including titles, summaries, and chapters, from private recordings owned by other users. Attackers can also trigger unauthorized AI generation jobs that consume the victim's AI credits without consent.

Critical Impact
Authenticated attackers can read private AI-generated video metadata belonging to arbitrary users and drain the video owner's AI credits through unauthorized generation requests.

Affected Products

Cap (CapSoftware/Cap) — screen recording application
GET /api/video/ai HTTP endpoint
Deployments prior to the fix commit 8d48642b6e7938af238386383ef1c273be4110dd

Discovery Timeline

2026-07-07 - CVE-2026-59704 published to the National Vulnerability Database
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59704

Vulnerability Analysis

Cap exposes an internal API route at GET /api/video/ai that returns AI-generated metadata for a video identified by an ID parameter. The endpoint enforces authentication but does not perform an authorization check tying the requested video ID to the caller's identity or workspace membership.

As a result, any authenticated account can enumerate or guess video IDs and retrieve titles, generated summaries, and chapter breakdowns for recordings that should remain private. The same endpoint can also initiate new AI generation runs on videos the caller does not own, billing the AI credit consumption to the legitimate video owner.

This class of flaw falls under Broken Access Control and Insecure Direct Object Reference (IDOR). The primary impact is confidentiality loss for AI-derived content, with a secondary financial and resource-exhaustion impact against the owning tenant.

Root Cause

The route handler resolves the video record directly from the supplied identifier and returns AI metadata without invoking an ownership or workspace-membership predicate. See the GitHub Issue Tracker and the VulnCheck Advisory for the underlying analysis.

Attack Vector

Exploitation requires only low-privileged authenticated access. An attacker registers or uses any Cap account, obtains a session token, and issues GET /api/video/ai?videoId=<target_id> requests against the target instance. Video IDs can be harvested from shared links, referrer headers, or by iterating identifier ranges. The endpoint responds with the target's AI metadata and, on request, triggers new generation jobs that debit the owner's AI credits. No user interaction from the victim is required.

Refer to the GitHub Pull Request for the code-level exploitation path and remediation logic.

Detection Methods for CVE-2026-59704

Indicators of Compromise

Requests to /api/video/ai where the authenticated user ID does not match the ownerId of the requested video record.
Bursts of GET /api/video/ai calls from a single session iterating across many distinct video IDs.
Unexpected AI-generation job records or credit-consumption events attributed to a video whose owner did not initiate the action.
Access-log entries for /api/video/ai originating from accounts with no prior interaction with the referenced videos.

Detection Strategies

Cross-reference application access logs against the video ownership table and alert when the caller is not the owner or workspace member.
Deploy anomaly rules for high-cardinality video ID enumeration by a single session or IP within a short time window.
Monitor AI billing and job queues for generation requests where the initiating user differs from the video owner.

Monitoring Recommendations

Forward Cap application and reverse-proxy logs to a centralized analytics platform and retain them for post-incident review.
Track per-user request rates against /api/video/ai and baseline normal access patterns to surface enumeration behavior.
Alert on sudden depletion of AI credits for individual tenants that does not correlate with owner-initiated activity.

How to Mitigate CVE-2026-59704

Immediate Actions Required

Upgrade Cap to a build that includes commit 8d48642b6e7938af238386383ef1c273be4110dd from the GitHub Commit Log.
Audit AI generation job history and credit ledgers to identify unauthorized runs initiated before patching.
Rotate or invalidate active sessions if exploitation is suspected, and notify affected video owners.

Patch Information

The maintainers merged the fix in GitHub Pull Request #1926, which adds ownership and workspace-membership checks to the GET /api/video/ai handler before returning metadata or triggering AI generation. Operators self-hosting Cap should pull the latest release from the GitHub Repository and redeploy.

Workarounds

Restrict network access to the /api/video/ai route via a reverse-proxy rule until the patch is deployed, allowing only trusted internal callers.
Temporarily disable AI metadata and generation features in the Cap configuration to remove the vulnerable code path from exposure.
Set conservative per-user rate limits on /api/video/ai to slow enumeration and reduce credit-drain impact.

bash

# Example nginx block to gate the vulnerable endpoint pending patch deployment
location = /api/video/ai {
    allow 10.0.0.0/8;
    deny all;
    limit_req zone=cap_ai burst=5 nodelay;
    proxy_pass http://cap_backend;
}