Executive brief
CAPEv2 is a malware analysis platform that allows security researchers to submit and analyze suspicious files. The REST API fails to properly verify that authenticated users only access their own analysis tasks, allowing any logged-in user to view, enumerate, and delete analysis reports belonging to other users. This can disrupt legitimate security investigations and expose sensitive analysis results.
Technical details
CAPEv2 REST API endpoints for task viewing and deletion lack proper ownership verification. The vulnerability exists in web/apiv2/views.py and affects the task view and delete endpoints, allowing any authenticated user to access or delete analyses submitted by other users by directly referencing task IDs. Authentication is required to exploit this vulnerability, but no additional authorization checks verify that the requesting user owns the target task. An attacker with API credentials can enumerate all tasks in the system and perform unauthorized deletion of analyses. The issue is present through commit 471ee4b; patches or fixes in later commits may be available.
Affected products
- Kevin O'Reilly CAPEv2 through commit 471ee4b
Timeline
- 2026-09-13: disclosed