Improper Access Control in chocobozzz/peertube

Valid

Reported on

Jan 8th 2022

Description

Unauthenticated users can obtain comments on private videos

Vísit the following API link where 123 is the ID of the private video:

/api/v1/videos/123/comment-threads

Response contains all the comments on that private video.

This vulnerability disclosure comments on private videos to unauthenticated users.

We are processing your report and will contact the chocobozzz/peertube team within 24 hours. a year ago

We have contacted a member of the chocobozzz/peertube team and are waiting to hear back a year ago

duongdpt modified the report

a year ago

chocobozzz validated this vulnerability a year ago

duongdpt has been awarded the disclosure bounty

The fix bounty is now up for grabs

chocobozzz marked this as fixed in Not released yet with commit 84c8d9 a year ago

chocobozzz has been awarded the fix bounty

This vulnerability will not receive a CVE

to join this conversation