CVE-2026-28354

CVE-2026-28354 is a medium-severity vulnerability in Oxygenz Clipbucket with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-639.

Key facts

Description

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_collections.php?mode=manage_items...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.

Frequently asked questions

What is CVE-2026-28354?
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_collections.php?mode=manage_items...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.
How severe is CVE-2026-28354?
CVE-2026-28354 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-28354 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-28354?
CVE-2026-28354 affects Oxygenz Clipbucket. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-28354?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-28354 have an EU (EUVD) identifier?
Yes. CVE-2026-28354 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9062.
When was CVE-2026-28354 published?
CVE-2026-28354 was published on 2026-02-27 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Oxygenz Clipbucket

All CVEs affecting Oxygenz Clipbucket →

Other CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities

Browse all CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities →