Executive brief
Cap, an open-source screen recording platform, contained a security flaw where any logged-in user could view private AI-generated metadata of other users' recordings. By providing a specific video ID to a vulnerable web endpoint, an attacker could read private titles, summaries, and chapter lists. Additionally, this flaw allowed unauthorized users to trigger AI processing that would consume the video owner's service credits without their permission.
Technical details
A missing authorization vulnerability (CWE-862) exists in the Cap screen recording platform within the `GET /api/video/ai` endpoint. The vulnerable component at `apps/web/app/api/video/ai/route.ts` fetched video metadata directly from the database using only a `videoId` parameter without invoking the `VideosPolicy.canView` check. An authenticated attacker could exploit this by supplying arbitrary video IDs to disclose sensitive AI-generated transcripts, summaries, and titles of private recordings. Furthermore, the endpoint could be used to trigger AI generation tasks, leading to resource/credit exhaustion for the victim. The issue was addressed in June 2026 by wrapping the affected endpoints in the standard `canView` policy gate.
Affected products
- CapSoftware Cap commit 8d48642 and earlier
Timeline
- 2026-06-04: disclosed: Initial report to maintainers
- 2026-06-19: patched: Fix merged in commit 8d48642
- 2026-07-07: advisory: CVE published to NVD