Skip to content
Heist/ feed
Back to feed
Medium

PeerTube Arbitrary Playlist Creation via ActivityPub Protocol

Type: advisorySources: OSV

This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-32946
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 17:11 UTC · Revision 1

Source evidence

PeerTube Arbitrary Playlist Creation via ActivityPub Protocol

core-osv · Original source

Published 15 Apr 2025, 12:58 UTC

This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.

osv:CVE-2025-32946
Complete source record
{
  "id": "4794c9920378dae1a51cc8885ba07e26801f28dfabfd70816d54019fece63d69",
  "url": "https://osv.dev/vulnerability/CVE-2025-32946",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "PeerTube Arbitrary Playlist Creation via ActivityPub Protocol",
    "summary": "This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.",
    "evidence": "osv:CVE-2025-32946",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-32946",
      "aliases": [
        "CVE-2025-32946"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/chocobozzz/peertube",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "b9c3a4837e6a5e5d790e55759e3cf2871df4f03c"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.1.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b9c3a4837e6a5e5d790e55759e3cf2871df4f03c"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v7.1.1"
                  },
                  {
                    "cpe": "cpe:2.3:a:framasoft:peertube:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.1.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v7.1.0",
            "v7.1.0-rc.1",
            "v7.0.1",
            "v7.0.0",
            "v7.0.0-rc.1",
            "v6.3.1",
            "v6.3.0",
            "v6.3.0-rc.1",
            "v6.2.1",
            "v6.2.0",
            "v6.2.0-rc.1",
            "v6.1.0",
            "v6.1.0-rc.1",
            "v6.0.2",
            "v6.0.1",
            "v6.0.0",
            "v6.0.0-rc.2",
            "v6.0.0-rc.1",
            "v5.2.0",
            "v5.2.0-rc.1",
            "v5.1.0-rc.1",
            "v5.0.0",
            "v5.0.0-rc.1",
            "v4.3.0",
            "v4.3.0-rc.1",
            "v4.2.0-rc.1",
            "v4.1.0",
            "v4.1.0-rc.1",
            "v4.0.0-rc.1",
            "v3.4.0",
            "v3.4.0-rc.1",
            "v3.3.0",
            "v3.3.0-rc.1",
            "v3.1.0-rc.1",
            "v3.0.0",
            "v3.0.0-rc.1",
            "v2.4.0",
            "v2.4.0-rc.1",
            "v2.3.0-rc.1",
            "v2.2.0-rc.1",
            "v2.1.0-rc.1",
            "v2.0.0",
            "v2.0.0-rc.1",
            "v1.4.0-rc.1",
            "v1.3.0-rc.1",
            "v1.1.0",
            "v1.1.0-rc.1",
            "v1.1.0-alpha.1",
            "v1.0.0-rc.2",
            "v1.0.0-rc.1",
            "v1.0.0-beta.16",
            "v1.0.0-beta.15",
            "v1.0.0-beta.14",
            "v1.0.0-beta.13",
            "v1.0.0-beta.12",
            "v1.0.0-beta.11",
            "v1.0.0-beta.10.pre.3",
            "v1.0.0-beta.10.pre.2",
            "v1.0.0-beta.10.pre.1",
            "v1.0.0-beta.9",
            "v1.0.0-beta.8",
            "v1.0.0-beta.7",
            "v1.0.0-beta.6",
            "v1.0.0-beta.5",
            "v1.0.0-beta.4",
            "v1.0.0-beta.3",
            "v1.0.0-beta.2",
            "v1.0.0-beta.1",
            "v1.0.0-alpha.10",
            "v1.0.0-alpha.9",
            "v1.0.0-alpha.8",
            "v1.0.0-alpha.7",
            "v1.0.0-alpha.6",
            "v1.0.0-alpha.5",
            "v1.0.0-alpha.4",
            "v1.0.0-alpha.3",
            "v1.0.0-alpha.2",
            "v1.0.0-alpha.1",
            "v0.0.29-alpha",
            "v0.0.28-alpha",
            "v0.0.27-alpha",
            "v0.0.23-alpha",
            "v0.0.22-alpha",
            "v0.0.21-alpha",
            "v0.0.20-alpha",
            "v0.0.19-alpha",
            "v0.0.18-alpha",
            "v0.0.17-alpha",
            "v0.0.16-alpha",
            "v0.0.14-alpha",
            "v0.0.13-alpha",
            "v0.0.12-alpha",
            "v0.0.11-alpha",
            "v0.0.9-alpha",
            "v0.0.8-alpha",
            "v0.0.6-alpha",
            "v0.0.5-alpha",
            "v0.0.4-alpha",
            "v0.0.3-alpha"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32946.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.764515119Z",
      "provider": "osv",
      "references": [
        "https://github.com",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32946.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-32946",
        "https://research.jfrog.com/vulnerabilities/peertube-arbitrary-playlist-creation-activitypub/",
        "https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-282"
        ],
        "cna_assigner": "JFROG",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32946.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-32946",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505185,
  "published_at": "2025-04-15T12:58:08.024+00:00"
}