Security Advisory
CVE-2026-59704
7.1
HIGH
Vulnerability Description
Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.
Published Date
July 7, 2026
Official Source
NIST NVD Advisory