Description

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-11T18:18:17.847Z",
  "pubdate": "2026-08-11T18:18:17.847Z",
  "executiveSummary": "Cap v0.3.1 suffers from a broken access control vulnerability residing in the POST /api/video/comment endpoint. This security flaw enables authenticated users to bypass authorization checks and successfully post comments on arbitrary private videos without holding the necessary permissions. The root cause stems from the application trusting the videoId parameter supplied in the request body without validating whether the requesting user owns or has authorized access to the targeted private video resource.\nThe business impact and risk implications include unauthorized content injection into private user recordings, potential harassment or phishing via injected comments, and inadvertent information disclosure. Specifically, successful exploitation triggers comment notification emails directed to the legitimate video owner and allows attackers to systematically enumerate valid video IDs by analyzing response differences returned by the API endpoint. Attacker capabilities require authenticated access to the platform, but demand no elevated privileges or administrative rights to target arbitrary private video assets across the system.",
  "technicalDetails": "The vulnerability is localized within the comment processing logic of the POST /api/video/comment endpoint in Cap v0.3.1. The vulnerable component fails to perform server-side access control validation to verify if the session-authenticated user possesses read and write permissions for the specific video resource referenced by the incoming videoId parameter.\nExploitation occurs over the network via HTTP POST requests directed at the API endpoint. An authenticated attacker constructs a malicious payload containing an arbitrary, guessed, or enumerated videoId corresponding to a private video record belonging to another user. Because the backend application lacks proper authorization enforcement, it processes the comment injection request blindly, associating the comment with the targeted private video.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the application using standard user credentials to obtain a valid session or token. Second, the attacker formulates an HTTP POST request to the POST /api/video/comment endpoint, supplying an arbitrary or sequentially enumerated videoId alongside the comment body. Third, the server processes the input and stores the comment against the specified video record, bypassing ownership validation checks. Fourth, the application triggers internal notification mechanisms, dispatching comment notification emails to the actual video owner. Finally, the attacker analyzes structural or content-based differences in the HTTP response payloads to determine whether the submitted videoId corresponds to a valid resource, enabling rapid enumeration of private video identifiers.\nPost-exploitation impact includes unauthorized data modification of private video spaces, information leakage regarding valid resource identifiers through differential responses, and potential social engineering risks through automated notification emails sent to victims from the platform."
}