CVE-2026-90768 in CAPE
Summary
by MITRE • 09/13/2026
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in CAPEv2 prior to commit 471ee4b represents a critical failure in access control mechanisms within its REST API infrastructure, specifically classified under CWE-639: Authorization Bypass Through User-Controlled Key. This flaw stems from the application's inability to properly validate task ownership when processing requests directed at endpoints responsible for viewing and deleting analysis tasks. In secure software architecture, particularly in multi-user environments like malware sandboxing platforms such as CAPEv2, it is imperative that every state-changing or sensitive data-access operation verifies that the requesting user possesses explicit permission over the specific resource being accessed. The absence of this verification logic creates a direct path for unauthorized access and manipulation of system resources.
From an operational perspective, authenticated users can exploit this weakness to enumerate all tasks currently stored in the system regardless of their ownership status. By sending HTTP requests to the task view endpoints without providing valid ownership tokens or session bindings that restrict scope to personal data, attackers can retrieve sensitive information contained within other users' malware analyses. This includes potentially confidential payload samples, behavioral logs, network traffic captures, and extracted artifacts which may reveal proprietary research methodologies or internal infrastructure details of competing organizations or individual researchers. The ability to read these resources constitutes a significant breach of confidentiality and intellectual property protection standards.
Furthermore, the vulnerability extends beyond mere data exfiltration to include destructive capabilities via the task delete endpoints. An attacker can arbitrarily delete analyses submitted by other users without authorization, leading to a denial of service for legitimate stakeholders who rely on these results for threat intelligence or incident response activities. This action disrupts operational continuity and compromises the integrity of the security analysis workflow. The lack of ownership verification means that any authenticated account, regardless of privilege level relative to specific tasks, can execute deletion commands against arbitrary task identifiers obtained through enumeration.
In terms of industry-standard mapping, this vulnerability aligns with MITRE ATT&CK technique T1078: Valid Accounts, as the exploitation requires initial authentication but then abuses those credentials to access resources outside their intended scope. It also reflects aspects of T1530: Data from Local System if the enumerated data includes local artifacts, and T1485: Data Destruction due to the capability to delete critical analysis records. The core issue is a fundamental flaw in object-level authorization logic where the application trusts client-supplied identifiers without cross-referencing them against the authenticated user's permission set or ownership database.
To mitigate this vulnerability, developers must implement strict server-side validation for all REST API endpoints that handle resource-specific actions such as viewing and deleting tasks. This involves ensuring that every request includes a verification step where the backend checks if the currently authenticated session owner matches the owner of the requested task ID before processing the operation. Additionally, implementing role-based access control (RBAC) policies can further restrict which user roles are permitted to view or delete specific types of analyses. Regular security audits and penetration testing focused on broken object level authorization should be conducted to identify similar flaws in other parts of the application logic. Updating CAPEv2 to versions released after commit 471ee4b is essential as this patch addresses the missing ownership validation checks, thereby restoring proper access control boundaries between users.