ClipBucket v5 contained an insecure direct object reference flaw that allowed an authenticated user to add or remove items from another user’s collection. The vulnerability stems from missing authorization checks in the add item endpoint and a broken ownership validate in the remove item function, permitting unauthorized data modification. The weakness is classified as CWE‑639 and CWE‑863, reflecting a lack of proper authorization enforcement and a broken check on ownership of objects.

All installations of ClipBucket version 5 prior to the 5.5.3‑#59 update are susceptible. The affected product is the open‑source video sharing platform ClipBucket v5, as released by MacWarrior. 5.5.3‑#59 and later releases contain the fix.

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the application; once logged in, they can exploit the missing checks to manipulate collections belonging to other users. The attack vector is a web‑based request to add or delete items, making it a local privilege escalation within the application context. Due to the moderate score and low exploitation likelihood, the risk is significant for systems that allow untrusted users access to collection management features but is not considered critical at this time.