---
id: CVE-2026-73039
title: >-
  streama contains an insecure direct object reference vulnerability in
  ViewingStatusController that allows authenticated users to read and delete
  other users' viewing status records
summary: >-
  streama contains an insecure direct object reference vulnerability in
  ViewingStatusController that allows authenticated users to read and delete
  other users' viewing status records. Attackers can enumerate all users' watch
  progress, dele…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-639
vendor: streamaserver
product: streama
affected:
  - streama < 1fa79534ee09e25f2473cc4787b106996008a442
published: '2026-08-13'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73039'
references:
  - url: 'https://github.com/streamaserver/streama'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442
    label: disclosure@vulncheck.com
  - url: 'https://github.com/streamaserver/streama/issues/1170'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00304
epssPercentile: 0.20663
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-14T18:03:08.748490Z'
ingestedAt: '2026-09-24T15:45:56.711Z'
---

## Overview

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.