← Back to the live CVE advisory feed

CVE-2026-90768: CAPEv2

Severity

8.6 (HIGH)

Vendor

KEVOREILLY

Affected versions

Versions of CAPEv2 through commit 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0 are affected.

Fixed version

unknown

Patch status

Unpatched

Published

2026-09-13T11:17:01.113

Modified

2026-09-13T11:17:01.113

Exploitation

Known exploited in the wild

Why it matters

This vulnerability allows authenticated attackers to access and delete sensitive analysis data created by other users within CAPEv2. This can lead to unauthorized data exposure, data loss, and disruption of operations, impacting data integrity and confidentiality. Admins should prioritize patching.

Recommended admin actions

• Monitor CAPEv2 official channels for patch availability and vendor advisories.
• Restrict access to CAPEv2 REST API endpoints to authorized personnel only.
• Implement enhanced logging for API task activity to detect suspicious enumeration or deletion attempts.
• Review and strengthen CAPEv2 access controls and user permissions.
• Assess the criticality of data in CAPEv2 and consider temporary isolation if unpatched.

Technical summary

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

View the official NVD record for CVE-2026-90768

AI-enriched (MEDIUM confidence). Validate against the vendor advisory before taking production action.