https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T20:56:49.426806+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-73039 CVE-2026-73039 — streama Insecure Direct Object Reference via ViewingStatusController 2026-09-28T20:56:49.445763+00:00

Affected: streamaserver streama

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.