Junglewise Threat Intelligence

CVE-2026-47238: MacWarrior ClipBucket IDOR in video subtitle editor

CVE-2026-47238 · Severity: medium · CVSS 6.5 · Published 2026-06-11

Technologies: MacWarrior ClipBucket. Vendors: MacWarrior.

Executive brief

ClipBucket is an open-source platform used for hosting and sharing videos. A security flaw allows any registered user to modify, upload, or delete subtitles on videos belonging to other users, including administrators. This could lead to the defacement of video content or the removal of important accessibility captions across the platform.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in ClipBucket v5 due to insufficient authorization checks in the subtitle management components. Specifically, the files `subtitle_popin_upload.php`, `subtitle_edit_core.php`, and `subtitle_delete.php` verify if a user has the general 'edit_video' permission but fail to validate if the user owns the specific video associated with the provided `videoid`. Since the default 'Registered User' level includes the 'edit_video' permission, any authenticated attacker can send crafted POST requests to `/actions/subtitle_edit.php` or `/actions/subtitle_save.php` to manipulate subtitles on any video. This allows for unauthorized uploading of .srt files, renaming of subtitle tracks, or deletion of existing captions. The issue is resolved in version 5.5.3 - #133.

Affected products

  • MacWarrior ClipBucket v5 <= 5.5.3 - #132

Timeline

  • 2026-05-22: advisory: Original GitHub security advisory published
  • 2026-06-11: disclosed: NVD publication date
  • 2026-06-11: patched: Patch confirmed in version 5.5.3 - #133

References

Related threats