CVE-2026-73039

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/streamaserver/streama
https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442
https://github.com/streamaserver/streama/issues/1170
https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller

Configurations

No configuration.

History

24 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) streama contiene una vulnerabilidad de referencia directa a objeto insegura en ViewingStatusController que permite a usuarios autenticados leer y eliminar registros de estado de visualización de otros usuarios. Los atacantes pueden enumerar el progreso de visualización de todos los usuarios, eliminar historial de visualización arbitrario y manipular los paneles ’Continuar Viendo’ de otros usuarios al proporcionar claves primarias arbitrarias sin verificación de propiedad.

Information

Published : 2026-08-13 22:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73039

Mitre link : CVE-2026-73039

CVE.ORG link : CVE-2026-73039

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-73039", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73039", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T18:03:08.748490Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/streamaserver/streama", "vendor": "streamaserver", "product": "streama", "versions": [{"status": "affected", "version": "0", "lessThan": "1fa79534ee09e25f2473cc4787b106996008a442", "versionType": "git"}], "packageURL": "pkg:github/streamaserver/streama", "defaultStatus": "affected"}]}], "published": "2026-08-13T22:17:25.203", "references": [{"url": "https://github.com/streamaserver/streama", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/streamaserver/streama/issues/1170", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification."}, {"lang": "es", "value": "streama contiene una vulnerabilidad de referencia directa a objeto insegura en ViewingStatusController que permite a usuarios autenticados leer y eliminar registros de estado de visualizaci\u00f3n de otros usuarios. Los atacantes pueden enumerar el progreso de visualizaci\u00f3n de todos los usuarios, eliminar historial de visualizaci\u00f3n arbitrario y manipular los paneles \u2019Continuar Viendo\u2019 de otros usuarios al proporcionar claves primarias arbitrarias sin verificaci\u00f3n de propiedad."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}