Cap v0.3.1 contains a broken access control flaw in the POST /api/video/comment endpoint that allows any authenticated user to post comments on any private video by supplying an arbitrary videoId. This flaw permits attackers to inject comments into private recordings belonging to other users, trigger comment notification emails to the video owners, and use response differences to enumerate valid video IDs. The vulnerability is a classic access control violation (CWE-862) and results in unauthorized modification of content and inadvertent disclosure of notification traffic.

The affected product is Cap from CapSoftware; specifically version 0.3.1 is vulnerable. No other affected versions are listed.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting a very low exploitation probability. The flaw is not listed in CISA’s KEV catalog. Attack requires an authenticated session; the attacker must first authenticate to Cap and then send the crafted POST request with a videoId that does not belong to them. The impact is limited to the ability to comment on private videos, but the effect of spamming notifications and mapping private video IDs can aid further attacks. Based on the description, the likely attack vector is authenticated user exploitation via the publicly documented API endpoint.