An authorization flaw in the CAPEv2 REST API allows authenticated users to read or delete sensitive analysis data belonging to other users, posing a significant risk to data integrity and confidentiality.

The application fails to perform proper ownership validation within its REST API task view and delete endpoints. Any authenticated user can bypass intended access controls to enumerate, view, and remove analysis tasks that they do not own.

The ability for unauthorized users to access and delete analysis results can lead to the compromise of sensitive malware intelligence and research data. With a CVSS score of 8.1, this vulnerability is classified as High severity, as it facilitates unauthorized data modification and potential loss of proprietary security insights. Unauthorized deletion of these records disrupts incident response workflows and may result in the loss of critical forensics evidence.

Immediate Action: Update the CAPEv2 installation to a version beyond commit 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0, where ownership validation logic has been implemented.

Proactive Monitoring: Review web server and application access logs for unusual patterns of API requests targeting task IDs, specifically monitoring for frequent DELETE requests or high volumes of GET requests from non-administrative accounts.

Compensating Controls: Implement strict API gateway controls or network level access restrictions to limit access to the REST API to known, trusted IP addresses or specific authenticated service accounts.

Public Exploit Available: exploit_available (unknown)

Given the High severity of this authorization bypass, organizations should prioritize updating their CAPEv2 deployment immediately to prevent unauthorized data manipulation. Restricting access to the REST API interface through network segmentation is highly recommended until the patch can be verified and applied in production environments.