CVE-2026-73039

Name of the Vulnerable Software and Affected Versions streama (affected versions not specified)

Description An insecure direct object reference (IDOR) occurs in the ViewingStatusController, where the application fails to verify ownership of records. This allows authenticated users to read and delete viewing status records of other users by providing arbitrary primary keys. Consequently, attackers can enumerate watch progress, delete arbitrary viewing history, and manipulate the Continue Watching dashboards of other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.