Medium severity5.3OSV Advisory· Published Apr 15, 2025· Updated Jun 17, 2026
CVE-2025-32946
CVE-2025-32946
Description
This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: v0.0.11-alpha, v0.0.12-alpha, v0.0.13-alpha, …
Patches
Vulnerability mechanics
References
2- research.jfrog.com/vulnerabilities/peertube-arbitrary-playlist-creation-activitypub/nvdExploitThird Party Advisory
- github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1nvdRelease Notes
News mentions
0No linked articles in our index yet.