CVE-2026-73090CWE-863broken-access-control

CVE-2026-73090

Critical · published August 11, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-11T22:18Z
References (3)
https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2 · [email protected]https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2 · [email protected]https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86 · [email protected]
EPSS history
Timeline
  • 11 AUG 17:19Z
    PeerTube: Cross-origin remote video takeover via Update activity
    cvelistv5