CVE-2026-73039

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73039
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73039.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73039
Published
2026-08-13T21:34:04Z
Modified
2026-08-16T03:30:57Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
streama Insecure Direct Object Reference via ViewingStatusController
Details

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73039.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1fa79534ee09e25f2473cc4787b106996008a442"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/streamaserver/streama

Affected ranges

Type
GIT
Repo
https://github.com/streamaserver/streama
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1fa79534ee09e25f2473cc4787b106996008a442
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

1.*
1.3.1_beta
1.3.3_beta
v0.*
v0.3.1
v0.3.2
v1.*
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.1
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.11.0
v1.11.1
v1.2.1_beta
v1.2.3_beta
v1.2_beta
v1.3.0_beta
v1.3.2_beta
v1.4.0_beta
v1.4.1RC3
v1.4.2
v1.5.1
v1.5.2
v1.6.0-FINAL
v1.6.0-RC1
v1.6.0-RC10
v1.6.0-RC2
v1.6.0-RC3
v1.6.0-RC4
v1.6.0-RC5
v1.6.0-RC6
v1.6.0-RC7
v1.6.0-RC8
v1.6.0-RC9
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.0-RC1
v1.7.0-RC10
v1.7.0-RC11
v1.7.0-RC12
v1.7.0-RC13
v1.7.0-RC2
v1.7.0-RC3
v1.7.0-RC4
v1.7.0-RC5
v1.7.0-RC6
v1.7.0-RC7
v1.7.0-RC8
v1.7.0-RC9
v1.7.1
v1.7.2
v1.7.3
v1.8.0-beta
v1.8.1
v1.8.2
v1.8.3
v1.9.2
v1.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73039.json"