CVE-2026-73039

MediumCVSS 5.4

Published: 13/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

streama has an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

Risk Assessment

An attacker can compromise user privacy, delete their viewing history, and manipulate their experience, potentially leading to loss of trust and dissatisfaction.

Recommendation

Update streama to a patched version. Implement ownership-based access control and validate that the user has permission to operate on a given record.

Other vulnerabilities in streama

CVE-2025-34452High
A vulnerability in Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 combines path traversal and SSRF in the subtitle download functionality. An authenticated attacker can write arbitrary files to the server filesystem, potentially leading to remote code execution.

Original NVD description (English source)

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS