CVE-2026-73039
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
streama has an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
Risk Assessment
An attacker can compromise user privacy, delete their viewing history, and manipulate their experience, potentially leading to loss of trust and dissatisfaction.
Recommendation
Update streama to a patched version. Implement ownership-based access control and validate that the user has permission to operate on a given record.
Original NVD description (English source)
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.