Insufficient Task Ownership Validation in CAPEv2 REST API

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CAPEv2 through commit 471ee4b contains a critical authorization flaw where REST API endpoints fail to verify task ownership before granting access. This vulnerability allows any authenticated user to read and delete malware analyses submitted by other users, as well as enumerate all tasks within the system. Organizations using CAPEv2 for collaborative malware analysis face data integrity risks, loss of investigative work, and potential exposure of sensitive analysis metadata. The vulnerability affects any deployment where multiple users or teams rely on CAPEv2 for threat research, incident response, or security operations.

Casky's 283 matching skills leverage Claude AI's reasoning to detect the attack patterns underlying this vulnerability across TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using Casky would identify indicators such as: unauthorized API calls to task endpoints from accounts lacking ownership rights, enumeration of task IDs outside an attacker's scope, batch deletion requests targeting analyses across different user contexts, and API responses revealing task metadata without proper access controls. The platform's extended reasoning capabilities would correlate these behavioral patterns against CAPEv2's expected authorization flows, surfacing policy violations where ownership verification is bypassed and flagging accounts performing reconnaissance on system-wide task inventories—critical signals that an authenticated attacker is exploiting the lack of input validation and access control checks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90768.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-90768

Casky has 283 skills that investigate the attack patterns behind CVE-2026-90768. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn