kevoreilly CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH kevoreilly CVE published 2026-09-13

CVE-2026-90768

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. This vulnerability enables attackers to enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification, potentially impacting system integrity and data a [truncated]