Authorization Flaws in ClipBucket Video Sharing Platform

CVE-2026-28354

What is CVE-2026-28354?

ClipBucket v5, an open-source video sharing platform, suffers from significant authorization vulnerabilities prior to version 5.5.3. These flaws enable authenticated users to manipulate collection items belonging to others, specifically through inadequate authorization checks during item addition and deletion processes. The affected functionalities, including adding items via /actions/add_to_collection.php and deleting items through /manage_collections.php?mode=manage_items, allow unauthorized actions due to a lack of proper ownership verification. This oversight poses a risk that could be exploited by malicious actors, compromising the integrity of user collections. The issue has been resolved in version 5.5.3.

References