5.3

CVE-2025-32946

Exploit

PeerTube Arbitrary Playlist Creation via ActivityPub Protocol

This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Framasoft ≫ Peertube Version < 7.1.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.229
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
reefs@jfrog.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-282 Improper Ownership Management

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1
Release Notes
https://research.jfrog.com/vulnerabilities/peertube-arbitrary-playlist-creation-activitypub/
Third Party Advisory
Exploit