Medium severity5.4NVD Advisory· Published Aug 13, 2026

CVE-2026-73039

Description

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

Affected products

Streamaserver/Streamallm-fuzzy

Patches

Vulnerability mechanics

References

github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442nvd
github.com/streamaserver/streama/issues/1170nvd
www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontrollernvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000