Description

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-13T11:17:01.113Z",
  "pubdate": "2026-09-13T11:17:01.113Z",
  "executiveSummary": "CAPEv2, through commit 471ee4b, contains a critical Broken Access Control vulnerability within its REST API implementation. The flaw originates from the failure to perform authorization checks regarding task ownership when processing requests for analysis retrieval or deletion. An authenticated user can bypass intended security boundaries to access or remove arbitrary analysis data submitted by other system users. This vulnerability allows for unauthorized information disclosure and denial-of-service via the deletion of sensitive security analysis reports. The risk is high as it enables horizontal privilege escalation, granting a standard authenticated user the capability to interact with data across the entire installation. Exploitation requires only a valid user account, as the backend does not validate the relationship between the session user and the requested resource identifier.",
  "technicalDetails": "The vulnerability resides in the REST API request handling logic of CAPEv2, specifically within the controllers responsible for task retrieval and task deletion. The system fails to enforce ownership validation, a process which should verify that the authenticated principal (user session) possesses the necessary permissions to access or modify a specific task ID passed as a parameter in the API call.\nRoot cause: The application logic trusts the client-provided task identifier without cross-referencing it against the ownership records stored in the underlying database. The API endpoints for viewing and deleting tasks do not implement middleware or internal checks to filter objects based on the 'owner' or 'user_id' associated with the analysis submission.\nExploitation flow: An attacker authenticated with standard privileges initiates a request to the REST API endpoints (e.g., /tasks/view/<task_id> or /tasks/delete/<task_id>). Because the application lacks ownership verification, the server executes the query to fetch or delete the record regardless of who submitted the analysis. An attacker can perform automated enumeration by iterating through consecutive or guessed task IDs, thereby scraping metadata, full analysis results, or reports from other users. Furthermore, sending a DELETE request to these endpoints allows the attacker to systematically remove analysis artifacts, leading to unauthorized data loss.\nAffected components: The REST API controller layer is the primary vulnerable component. All versions of CAPEv2 up to and including commit 471ee4b are susceptible to this flaw. Authentication is required to reach the API, but the lack of granular authorization effectively renders the authentication mechanism insufficient for protecting per-user data.\nImpact: Successful exploitation results in complete loss of confidentiality for analysis data and the ability to perform a denial-of-service attack on the integrity of the analysis database. There is no requirement for administrative privileges; a standard low-privilege user account is sufficient to compromise any or all other users' datasets."
}