CVE-2026-90768

CAPEv2, an open-source malware analysis sandbox, through commit 471ee4b fails to validate task ownership in its REST API task view and delete endpoints (CWE-862, missing authorization). Any authenticated user can send requests to these endpoints to enumerate every task in the system, read analysis results submitted by other users, and delete arbitrary analyses. An attacker gains cross-tenant disclosure of potentially sensitive malware analysis data and the ability to destroy other users' work, which disrupts SOC and threat-research workflows; CVSS 4.0 is rated high at 8.6. All deployments running the code through commit 471ee4b are affected. There is no known public PoC, it is not in the CISA KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Update CAPEv2 to a commit after 471ee4b that includes ownership verification on the task view and delete endpoints. Until patched, restrict REST API access to trusted networks and authenticated, least-privilege accounts, and place the web/API front end behind a VPN or reverse proxy with access controls. Review API and task logs for evidence of task enumeration or deletions performed by accounts that did not own those analyses.