CVE-2026-73039
streama Insecure Direct Object Reference via ViewingStatusController
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
| CWE | CWE-639 |
| Vendor | streamaserver |
| Product | streama |
| Published | Aug 13, 2026 |
| Last Updated | Sep 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for streamaserver streama
Be the first to know when new medium vulnerabilities affecting streamaserver streama are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
streamaserver / streama
0 < 1fa79534ee09e25f2473cc4787b106996008a442
References
github.com: https://github.com/streamaserver/streama/issues/1170 github.com: https://github.com/streamaserver/streama github.com: https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442 vulncheck.com: https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller
Credits
George Chen