CVE-2026-73039CWE-639

CVE-2026-73039

Medium · published August 14, 2026

CVSS v3.1

5.4

EPSS

Percentile

22.0

In the wild

Unconfirmed

What it is

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00304 · 22.0th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-08-14T02:17Z

References (4)

https://github.com/streamaserver/streama · [email protected]https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442 · [email protected]https://github.com/streamaserver/streama/issues/1170 · [email protected]https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller · [email protected]

EPSS history

Timeline

13 AUG 21:34Z
streama Insecure Direct Object Reference via ViewingStatusController
cvelistv5