NVD HIGH: CVE-2026-59704 — Cap's GET /api/video/ai endpoint fails to validate user ownership or membership ...

Tuesday, July 7, 2026 at 11:16 PM UTC·Source: NIST NVD

Updated: Wednesday, July 8, 2026 at 12:00 AM UTC

Executive Summary

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-59704

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Jul 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

NatWest Boxed and Mettle CTO Wayne Freeman leaves

The chief technology officer of NatWest's Boxed Banking-as-a-Service unit and its Mettle digital account for UK small businesses has stepped down.

2h agoFinextra

MEDIUMVulnerability

Italian fintech Satispay partners Mastercard for debit card launch

Italian fintech unicorn Satispay has taken another step towards building out its "superapp" by joining forces with Mastercard to launch debit cards and adding the ability to invest in stocks and ETFs.

2h agoFinextra

CRITICALVulnerability

NVD CRITICAL: CVE-2026-59705 — mem0's openmemory/api component contains an unauthenticated access vulnerability...

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints wit

CVE-2026-59705

3h agoNIST NVD