EUVD-2026-58542
GHSA-pr4j-5x2h-5vr8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authentication required (PR:L); impact limited to viewing history records (C:L/I:L); no scope change and no availability impact justified.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
AnalysisAI
Insecure direct object reference in streama's ViewingStatusController exposes all authenticated users' viewing history to lateral enumeration, deletion, and manipulation by any peer authenticated user. The list endpoint previously returned all users' ViewingStatus records without filtering, and read, update, and delete operations accepted arbitrary primary keys without ownership verification, enabling cross-user data access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user account on the target streama instance (confirmed by PR:L in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 and accurately reflects a medium-severity issue requiring authentication (PR:L) with limited confidentiality and integrity impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated streama user issues a GET request to the ViewingStatusController list endpoint and receives all other users' viewing records in the response, since the unpatched endpoint performs no user filtering. The attacker then iterates through the returned record IDs, issuing DELETE requests to wipe targeted users' watch progress, or crafting UPDATE requests to corrupt their 'Continue Watching' dashboards. … |
| Remediation | Apply upstream fix commit `1fa79534ee09e25f2473cc4787b106996008a442` from the streama GitHub repository (https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today