CVE-2026-73039

The CVSS 5.4 rating on this IDOR is misleading, and not in the way you'd expect. The vulnerability—unrestricted deletion and enumeration of 'Continue Watching' records—sits in the part of the application developers treat as cosmetic. They build billing and authentication with strict authorization; they build viewing history as wallpaper. That's exactly where IDORs breed, and that's why this flaw is more dangerous than its score suggests. The critical distinction: this isn't primarily a data-leakage vulnerability. It's a UX-manipulation vector. An attacker who can delete arbitrary watch history doesn't steal information—they corrupt a user's memory device. People may re-watch completed content, miss what they intended to finish, or lose context like content warnings they had noted. In corporate training environments, this creates audit exposure: if compliance systems trust viewing history as evidence of completion, deleted records mean unreliable audit trails with potential legal consequences. The enumeration capability compounds this. Harvesting watch histories at scale reconstructs behavioral profiles—stress levels, political interests, health concerns, relationship problems. Each record alone is benign. The corpus is weaponizable, exactly as demonstrated in previous waves: Strava heatmaps revealing military installations, location data identifying intelligence personnel. This is the third wave of a predictable pattern where "soft" entertainment data gets dismissed until someone proves the harm model. What makes this particularly risky: the EPSS score suggesting limited automated exploitation is irrelevant to the actual threat. Streama is typically self-hosted—family members, coworkers, students sharing an instance. The "authentication required" gate doesn't protect against insiders. One authenticated user with low-and-slow access can enumerate every other user's viewing patterns, build comprehensive behavioral profiles, and selectively corrupt records to undermine what the system believes users have watched. Check your deployment: are there downstream systems—billing, compliance, parental controls, recommendation engines—relying on Continue Watching as authoritative data? Those dependencies often accumulate invisibly, built by teams who never thought to add a security review. The vulnerability sits in forgotten code written against forgotten assumptions, in the sediment layer where organizational memory has eroded. Prioritize this based on your actual threat model, not CVSS. If you have shared accounts, multi-user access, or compliance requirements, treat this as exploitable by default. The regulatory trajectory for behavioral data is already mapped—financial and health data followed this exact path from dismissal to regulation. The gap between proof-of-concept and regulatory response is closing faster each wave.

Reviewed through automated stages and approved by a human before publication.