Description
Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cap | Cap | ≤ 8d48642 | — |
References
- GitHub Issue issue-tracking
- Product product
- Patch Commit patch
- https://www.vulncheck.com/advisories/cap-missing-access-control-in-video-ai-metadata-endpoint third-party-advisory
- Pull Request issue-tracking patch