Executive brief
ClipBucket is an open-source platform used for hosting and sharing videos. A security flaw allows any registered user to modify, upload, or delete subtitles on videos belonging to other users, including administrators. This could lead to the defacement of video content or the removal of important accessibility captions across the platform.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in ClipBucket v5 due to insufficient authorization checks in the subtitle management components. Specifically, the files `subtitle_popin_upload.php`, `subtitle_edit_core.php`, and `subtitle_delete.php` verify if a user has the general 'edit_video' permission but fail to validate if the user owns the specific video associated with the provided `videoid`. Since the default 'Registered User' level includes the 'edit_video' permission, any authenticated attacker can send crafted POST requests to `/actions/subtitle_edit.php` or `/actions/subtitle_save.php` to manipulate subtitles on any video. This allows for unauthorized uploading of .srt files, renaming of subtitle tracks, or deletion of existing captions. The issue is resolved in version 5.5.3 - #133.
Affected products
- MacWarrior ClipBucket v5 <= 5.5.3 - #132
Timeline
- 2026-05-22: advisory: Original GitHub security advisory published
- 2026-06-11: disclosed: NVD publication date
- 2026-06-11: patched: Patch confirmed in version 5.5.3 - #133