CVE-2025-32946: PeerTube Arbitrary Playlist Creation via ActivityPub Protocol
This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32946?
CVE-2025-32946 is classified as a high-severity vulnerability due to its ability to allow unauthorized users to manage playlists on other users' channels.
How do I fix CVE-2025-32946?
To fix CVE-2025-32946, upgrade to the latest version of PeerTube, specifically version 7.1.1 or higher.
Who is affected by CVE-2025-32946?
CVE-2025-32946 affects users of PeerTube who have not updated their software to the secure version.
What type of attack is possible with CVE-2025-32946?
CVE-2025-32946 enables an attacker to add arbitrary playlists to any user’s channel, compromising user control and privacy.
What does the ActivityPub protocol have to do with CVE-2025-32946?
CVE-2025-32946 leverages the ActivityPub protocol to exploit the vulnerability in PeerTube's playlist management system.