ClipBucket v5 contains an Insecure Direct Object Reference flaw in the subtitles editor that allows an authenticated user with normal privileges to edit, rename or delete another user’s subtitles. The attacker can upload new subtitle files, modify the filenames or delete existing ones, effectively tampering with the video’s metadata and potentially inserting malicious content. This represents a data integrity violation and could be used to influence user experience or hide malicious language in subtitles.

The vulnerability affects the MacWarrior ClipBucket v5 platform prior to version 5.5.3‑#133. The affected product is the open‑source video sharing application released by MacWarrior. Users running any version of ClipBucket v5 older than 5.5.3 are susceptible, while newer releases include the fix.

The flaw has a CVSS score of 6.5, indicating moderate severity. EPSS data is not available, but KEV does not list this vulnerability, suggesting it is not known to be widely exploited. The likely attack vector requires an authenticated user to act against another user’s subtitles; an attacker would need valid credentials but can leverage ordinary user accounts. Because the vulnerability is an authorization bypass, any authenticated user can discover and exploit it without additional preconditions.