Description
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
Published: 2026-08-13
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an insecure direct object reference in the ViewingStatusController that allows an authenticated user to supply arbitrary record identifiers and read or delete other users' viewing progress. This results in unauthorized data disclosure and loss of user history, which can compromise user experience and data integrity.

Affected Systems

The affected product is Streama, a media streaming web application. Specific vendor information is listed as Fosowl:AgenticSeek. No version details are provided, so the vulnerability may exist in any released iteration before a fix is applied.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and can exploit the flaw by directly addressing the controller with a crafted primary key. There is no known published exploit at this time, but the lack of ownership verification means any authenticated user can enumerate all watch progress records.

Generated by OpenCVE AI on August 14, 2026 at 00:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Streama to the latest version that includes a fix for the insecure direct object reference in ViewingStatusController.
  • Restrict access to ViewingStatusController so that only authorized roles can read or delete status records, adding ownership checks for each request.
  • Auditorily review application logs for suspicious viewing status deletions and delete any unauthorized records.

Generated by OpenCVE AI on August 14, 2026 at 00:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Fosowl
Fosowl agenticseek
Vendors & Products Fosowl
Fosowl agenticseek

Thu, 13 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
Title streama Insecure Direct Object Reference via ViewingStatusController
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Fosowl Agenticseek
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-13T21:34:04.344Z

Reserved: 2026-08-10T18:48:59.023Z

Link: CVE-2026-73039

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T22:17:25.203

Modified: 2026-08-13T22:17:25.203

Link: CVE-2026-73039

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T02:15:03Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key