CVE-2026-28354
ClipBucket v5 has IDOR in Collection Item Management
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_collections.php?mode=manage_items...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.
| CWE | CWE-639 CWE-863 |
| Vendor | macwarrior |
| Product | clipbucket-v5 |
| Published | Feb 27, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for macwarrior clipbucket-v5
Be the first to know when new unknown vulnerabilities affecting macwarrior clipbucket-v5 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
MacWarrior / clipbucket-v5
< 5.5.3 - #59