High 8.1Published Sep 13, 2026

CVE-2026-90768CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects kevoreilly CAPEv2. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for kevoreilly CAPEv2

Exploited in the last 30 days

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Sep 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

kevoreilly CAPEv2 kevoreilly:capev2 (from the name)	through 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0	CNA record

References

https://github.com/kevoreilly/CAPEv2/issues/3162issue-tracking
https://github.com/kevoreilly/CAPEv2product
https://github.com/kevoreilly/CAPEv2/blob/1255b18/web/apiv2/views.pytechnical-description
https://www.vulncheck.com/advisories/capev2-through-commit-471ee4b-rest-api-task-endpoints-missing-ownership-checkthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.