High severity · published Sep 13, 2026
CVE-2026-90768
CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
CAPEv2 · kevoreilly
through 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90768
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90768
github.com
https://github.com/kevoreilly/CAPEv2
github.com
https://github.com/kevoreilly/CAPEv2/blob/1255b18/web/apiv2/views.py
github.com
https://github.com/kevoreilly/CAPEv2/issues/3162
www.vulncheck.com
https://www.vulncheck.com/advisories/capev2-through-commit-471ee4b-rest-api-task-endpoints-missing-ownership-check