What is the CVSS score of CVE-2026-47238?

CVE-2026-47238 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

ClipBucket v5 CVE-2026-47238

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-11 GitHub_M

Authentication Bypass Clipbucket V5

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L overrides the provided PR:N because description explicitly requires an authenticated user; C:N as no data disclosure is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 23:17 vuln.today

DescriptionCVE.org

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, edit their name or delete them. This issue has been patched in version 5.5.3 - #133.

AnalysisAI

ClipBucket v5's subtitle management feature lacks ownership verification, enabling any authenticated user to upload, rename, or delete subtitle tracks on videos belonging to other users. All releases prior to version 5.5.3 - #133 (CPE: cpe:2.3:a:macwarrior:clipbucket-v5) are affected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low attack complexity and network accessibility present credible risk in any multi-user ClipBucket deployment.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the subtitle management endpoint accepts a user-supplied resource identifier (subtitle ID or video ID) without checking whether the requesting user is the owner of that resource. ClipBucket v5 is an open-source PHP-based video sharing platform maintained under the macwarrior/clipbucket-v5 GitHub repository. The CPE string cpe:2.3:a:macwarrior:clipbucket-v5:*:*:*:*:*:*:*:* confirms all version lines of this specific package are affected up to the patch. The flaw is a classic IDOR (Insecure Direct Object Reference) pattern - a subclass of CWE-639 - where resource authorization is tied to knowledge of an ID rather than enforced server-side ownership checks.

RemediationAI

Upgrade ClipBucket v5 to version 5.5.3 - #133 or later, which introduces the missing ownership authorization check on subtitle management endpoints. The fix is confirmed by the GitHub security advisory at https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-x468-whmw-c863. If immediate upgrade is not possible, a compensating control is to restrict subtitle management API endpoints (upload, rename, delete) to administrator roles only via web server access controls or application-level middleware - note this trade-off disables subtitle self-service for all users. Alternatively, implementing rate limiting and monitoring on subtitle modification endpoints can help detect enumeration behavior. No workaround eliminates the root authorization flaw without code changes.