CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users of CAPEv2 to bypass ownership validation in REST API endpoints, enabling them to read and delete analyses submitted by other users. This flaw poses a significant risk as it permits attackers to enumerate all tasks and delete arbitrary analyses, potentially leading to data loss and privacy breaches. Organizations using CAPEv2 should prioritize addressing this issue to safeguard user data and maintain system integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.