What’s Vulnerable › Vulnerabilities
CVE-2026-28354: ClipBucket v5 has IDOR in Collection Item Management
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-02-27 · updated 2026-06-17
- Weakness: CWE-639
Description
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_collections.php?mode=manage_items...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.
Affected products
- MacWarrior clipbucket-v5: from 5.3 before 5.5.3-59 — fixed in 5.5.3-59
How to fix
Upgrade to a fixed version: MacWarrior clipbucket-v5 5.5.3-59. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-28354 or the next vulnerability affects your stack