← Back

CVE-2025-32946

nvd nist
Published: Apr 15, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: reefs@jfrog.com (Secondary)

Description

This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.

Affected (1)

Products: Framasoft: Peertube
Framasoft
1 product
Peertube
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Peertube
Before 7.1.1

Related CWEs

CWE-282
Improper Ownership Management
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

References (2)

Source: reefs@jfrog.com
Release Notes
Source: reefs@jfrog.com
ExploitThird Party Advisory

Timeline

No history available yet.