CVE-2026-73039

Received Received - Intake

Authenticated IDOR in Streama Exposes User Viewing Status

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73039

EUVD

EUVD-2026-58542

Affected Vendors & Products

Vendor	Product	Version / Range
streama	streama	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure direct object reference in streama's ViewingStatusController. It allows authenticated users to access and manipulate other users' viewing status records without proper ownership checks. Attackers can read viewing progress, delete history, and alter Continue Watching dashboards by providing arbitrary user IDs.

Detection Guidance

This vulnerability can be detected by checking for unauthorized access to viewing status records. Look for unusual API calls to ViewingStatusController endpoints with arbitrary user IDs. Monitor for deleted viewing history or manipulated Continue Watching dashboards without user action.

Impact Analysis

If you use streama, an attacker with access could view your private viewing history, delete your watch progress, or modify your Continue Watching list. This could expose sensitive viewing preferences or disrupt your user experience by altering your dashboard.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR by exposing users' personal viewing data without consent. It may also conflict with HIPAA if viewing history includes protected health-related content, as unauthorized access to such data is prohibited.

Mitigation Strategies

Implement ownership verification for all ViewingStatusController actions. Ensure users can only access their own viewing status records. Review and restrict API endpoints to prevent unauthorized enumeration or deletion of user data.

Hi! I’m here to help you understand CVE-2026-73039. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70