Description

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-13T22:17:25.203Z",
  "pubdate": "2026-08-13T22:17:25.203Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability has been identified in the streama application, specifically within the ViewingStatusController component. This security flaw allows authenticated users to read and delete viewing status records belonging to other users.\nThe primary impact of this vulnerability includes the unauthorized enumeration of watch progress across the entire user base, the deletion of arbitrary viewing history, and the manipulation of other users' Continue Watching dashboards.\nThe affected product is streama. The risk implications are significant regarding user privacy and data integrity, as unauthorized actors can interfere with the application state of other accounts without possessing elevated administrative privileges.\nThe attacker capabilities require authentication to the platform, enabling them to supply arbitrary primary keys within requests targeting the vulnerable controller without undergoing proper ownership verification checks.\nExploitation requires valid user authentication to interact with the target endpoints, after which the lack of server-side authorization validation permits direct manipulation of foreign resource identifiers.",
  "technicalDetails": "The vulnerability stems from insufficient authorization checks within the ViewingStatusController component of streama. The root cause is the application's reliance on client-supplied primary keys to retrieve, modify, or delete viewing status records without verifying whether the currently authenticated user owns or is authorized to access the targeted resource.\nThe vulnerable component is the ViewingStatusController, which handles requests related to user watch history and progress. Authentication is required to access the system, but the lack of granular, object-level access control permits any authenticated user to interact with records outside their security context.\nThe exploitation method relies on parameter manipulation. During standard operations, the application processes requests containing primary keys corresponding to viewing status entries. An attacker exploits this by systematically or arbitrarily altering the primary key values within HTTP requests directed at the ViewingStatusController.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the streama application using a standard user account. Second, the attacker initiates an action, such as an HTTP GET or DELETE request, targeting viewing status endpoints. Third, the attacker substitutes the legitimate resource identifier with an arbitrary primary key belonging to another user. Fourth, the server processes the request and executes the read or delete operation against the referenced record because it fails to validate ownership against the session context.\nPayload behavior involves submitting sequential or guessed primary key integers or UUIDs to enumerate and harvest watch progress data or issue destructive commands against foreign viewing history entries.\nThe post-exploitation impact allows malicious actors to systematically violate user privacy by mapping out media consumption habits, corrupt user dashboards by purging Continue Watching entries, and disrupt the overall application state for targeted accounts."
}