CVE-2026-69113: Cap v0.3.1 Auth Bypass Vulnerability

CVE-2026-69113 Overview

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint. The endpoint fails to validate whether the authenticated user has permission to comment on the video referenced by the videoId in the request body. Authenticated attackers can post comments on private videos owned by other users, trigger notification emails to those owners, and enumerate valid video IDs based on differences in server responses. The flaw is classified as CWE-862: Missing Authorization.

Critical Impact
Any authenticated Cap user can inject comments into private video recordings belonging to other tenants, send unsolicited notifications to owners, and enumerate private video identifiers.

Affected Products

Cap v0.3.1 (open-source screen recording platform by CapSoftware)
Cap Web application (apps/web)
The newComment server action handling /api/video/comment requests

Discovery Timeline

2026-08-11 - CVE-2026-69113 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-69113

Vulnerability Analysis

Cap is an open-source screen recording and video sharing platform. The POST /api/video/comment endpoint accepts a JSON body containing a content string and a videoId. In v0.3.1 the server action trusts the videoId supplied by the client without verifying that the authenticated user is authorized to view or comment on the target video. Because Cap supports private videos scoped to specific owners or shared users, this omission collapses the access boundary between tenants.

An attacker with any valid account can iterate through candidate videoId values and submit comments. Comments on private videos generate notification emails to the owner, providing a channel for harassment or phishing. Response differences between valid and invalid IDs also enable enumeration of private video identifiers.

Root Cause

The newComment server action in apps/web/actions/videos/new-comment.ts inserts a record into the comments table using the client-supplied videoId without loading the corresponding video and evaluating an authorization policy. The fix introduces a VideosPolicy check and looks up the target row in the videos table using drizzle-orm's eq predicate before inserting the comment.

Attack Vector

Exploitation requires only a low-privileged authenticated session and network access to the Cap web application. The attacker sends an HTTP POST request to /api/video/comment with an arbitrary videoId belonging to another user. No user interaction from the victim is required.

typescript

// Security patch in apps/web/actions/videos/new-comment.ts
// Merge pull request #2070 from CapSoftware/codex/fix-comment-idor
 import { db } from "@cap/database";
 import { getCurrentUser } from "@cap/database/auth/session";
 import { nanoId } from "@cap/database/helpers";
-import { comments } from "@cap/database/schema";
+import { comments, videos } from "@cap/database/schema";
+import { provideOptionalAuth, VideosPolicy } from "@cap/web-backend";
 import type { ImageUpload } from "@cap/web-domain";
-import { Comment, type Video } from "@cap/web-domain";
+import { Comment, Policy, type Video } from "@cap/web-domain";
+import { eq } from "drizzle-orm";
+import { Effect, Exit } from "effect";
 import { revalidatePath } from "next/cache";
 import { createNotification } from "@/lib/Notification";
+import * as EffectRuntime from "@/lib/server";
 
 export async function newComment(data: {
 	content: string;

Source: GitHub Commit 1b812d8. The patch imports the videos schema and VideosPolicy, then evaluates the policy against the resolved video row before persisting the comment.

Detection Methods for CVE-2026-69113

Indicators of Compromise

Comment rows in the comments table whose videoId references a video owned by an unrelated userId.
Outbound comment notification emails delivered to video owners without a corresponding legitimate viewer session.
Bursts of POST /api/video/comment requests from a single authenticated session iterating sequential or random videoId values.

Detection Strategies

Query the application database for comments where the commenter is not the owner and is not on the video's shared-access list.
Analyze web server access logs for repeated POST /api/video/comment requests returning mixed success and error status codes from one user.
Correlate notification email volume per owner with expected commenting patterns to surface anomalies.

Monitoring Recommendations

Alert on any single authenticated principal generating comments on more than a small threshold of distinct videos in a short window.
Enable audit logging for the newComment server action, capturing userId, videoId, and authorization outcome.
Review GitHub Issue #1982 and the VulnCheck Advisory on Cap for updated indicators.

How to Mitigate CVE-2026-69113

Immediate Actions Required

Upgrade Cap to a build that includes commit 1b812d88958f784ee66d2eace60e731624832c9d from the Cap repository.
Audit the comments table for entries created before the patch date and remove unauthorized comments.
Rotate any video IDs that were exposed publicly through enumeration if your deployment relies on ID secrecy.

Patch Information

The upstream fix is delivered in pull request #2070 (codex/fix-comment-idor), commit 1b812d88958f784ee66d2eace60e731624832c9d. The patch adds a VideosPolicy check in apps/web/actions/videos/new-comment.ts that loads the target video by ID and evaluates the caller's authorization before inserting a comment. Self-hosted operators should rebuild the apps/web container from a tagged release containing this commit.

Workarounds

Restrict access to the Cap web application to trusted users only until the patch is deployed.
Place the /api/video/comment endpoint behind a reverse-proxy rule that requires additional authorization headers verified out-of-band.
Temporarily disable comment notification emails to reduce abuse potential while the patch is being rolled out.

bash

# Verify the deployed commit contains the fix
cd Cap
git log --oneline | grep 1b812d8
# Expected output includes: 1b812d8 Merge pull request #2070 from CapSoftware/codex/fix-comment-idor

# Rebuild and redeploy the web application
pnpm --filter @cap/web build
docker compose up -d --build web