CVE-2026-28354: ClipBucket v5 has IDOR in Collection Item Management
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/addtocollection.php) due to missing authorization checks and delete item (/managecollections.php?mode=manageitems...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28354?
CVE-2026-28354 has been classified with a moderate severity due to the potential for unauthorized modifications to user collection items.
How do I fix CVE-2026-28354?
To fix CVE-2026-28354, upgrade ClipBucket to version 5.5.3 or later to mitigate the authorization flaws.
What is the impact of CVE-2026-28354?
The impact of CVE-2026-28354 allows authenticated users to modify or manipulate another user's collection items, leading to unauthorized access.
Who is affected by CVE-2026-28354?
Users of ClipBucket versions prior to 5.5.3 are affected by CVE-2026-28354 due to the IDOR vulnerability in collection item management.
What is IDOR in the context of CVE-2026-28354?
IDOR stands for Insecure Direct Object Reference, and in CVE-2026-28354 it refers to the flaw that allows unauthorized access to another user's collection items.