CVE-2026-90768: CAPEv2 Authentication Bypass Vulnerability

CVE-2026-90768 Overview

CAPEv2, an open-source automated malware analysis sandbox, contains a broken access control flaw in its REST API. Through commit 471ee4b, the API endpoints responsible for viewing and deleting analysis tasks do not verify that the requesting user owns the referenced task. Any authenticated user can enumerate tasks submitted by other users and delete arbitrary analyses. The weakness is tracked as CWE-862: Missing Authorization.

Critical Impact
Authenticated low-privilege users can read confidential malware analyses submitted by other analysts and destroy arbitrary analysis records, undermining investigation integrity in shared CAPEv2 deployments.

Affected Products

CAPEv2 automated malware analysis sandbox through commit 471ee4b
REST API v2 endpoints defined in web/apiv2/views.py
Multi-tenant CAPEv2 installations that rely on per-user task isolation

Discovery Timeline

2026-09-13 - CVE-2026-90768 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90768

Vulnerability Analysis

CAPEv2 exposes a REST API that allows users to submit files or URLs for sandbox analysis and later retrieve or manage the resulting task records. In the affected commit, the task view and task delete endpoints in web/apiv2/views.py accept a task identifier and act on it without cross-referencing the authenticated user against the task owner. As a result, task IDs act as unprotected direct object references.

An attacker with a valid API account can iterate through sequential task IDs to enumerate every analysis in the system, including submissions from other tenants or analysts. The same authorization gap on the delete endpoint permits destruction of any task record, breaking chain-of-custody for investigations and enabling anti-forensic behavior against incident response teams that share a CAPEv2 instance.

Root Cause

The root cause is missing authorization logic ([CWE-862]) in the REST API view handlers. The endpoints authenticate the caller but never compare the caller's user ID against the owner attribute stored on the task record before returning data or performing a deletion. See the upstream source at CAPEv2 web/apiv2/views.py and issue #3162 for the specific handlers.

Attack Vector

Exploitation requires network reachability to the CAPEv2 API and any valid low-privilege API credential. The attacker issues authenticated GET requests to the task view endpoint while incrementing the task ID parameter to harvest analyses. Authenticated DELETE requests to the task delete endpoint with an arbitrary task ID remove that record. No user interaction is required, and the request pattern is indistinguishable from legitimate API traffic aside from the identity mismatch between requester and task owner. Refer to the VulnCheck advisory for additional context.

Detection Methods for CVE-2026-90768

Indicators of Compromise

Authenticated API requests to task view endpoints where the requesting user does not match the task owner field in the CAPEv2 database.
Bursts of sequential task ID lookups from a single API token, indicating enumeration behavior.
Unexpected DELETE requests against /apiv2/tasks/delete/ style routes originating from non-administrative accounts.

Detection Strategies

Correlate CAPEv2 web server access logs with the internal task ownership table to flag cross-user reads and deletes.
Alert on any user account that accesses more than a small threshold of distinct task IDs within a short window.
Baseline normal API usage per account and detect deviations such as first-time use of the delete endpoint.

Monitoring Recommendations

Forward CAPEv2 nginx or uWSGI access logs and Django application logs to a centralized analytics platform for retention and correlation.
Enable audit logging on the CAPEv2 database to capture task read and delete operations with the acting user identity.
Monitor API token issuance and revoke tokens that exhibit enumeration patterns.

How to Mitigate CVE-2026-90768

Immediate Actions Required

Restrict network access to the CAPEv2 REST API to trusted analyst workstations using firewall or reverse-proxy allowlists.
Rotate all existing API tokens and issue new credentials scoped to the minimum required privileges.
Audit the task database for unexpected deletions or reads and restore analyses from backup if tampering is suspected.

Patch Information

No fixed release is referenced in the NVD record at the time of publication. Monitor the CAPEv2 GitHub repository and issue #3162 for an upstream fix that adds ownership validation to the task view and delete handlers. When available, apply the patch and redeploy the web tier.

Workarounds

Operate CAPEv2 as a single-tenant service so all authenticated users are already authorized to view every task.
Front the REST API with an authorizing reverse proxy that rewrites or filters task IDs based on the authenticated user.
Disable the REST API entirely and require submissions through the web UI until an ownership-aware patch is deployed.

bash

# Example nginx restriction limiting REST API access to trusted analyst subnets
location /apiv2/ {
    allow 10.20.30.0/24;    # analyst workstations
    deny all;
    proxy_pass http://127.0.0.1:8000;
}