CVE-2026-73090

9.3 Critique

Publiée le 11/08/2026 à 20:18 · Modifiée le 09/09/2026 à 22:46 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.

Traduire en français

Produits concernés

Chocobozzz PeerTube

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.3 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2
https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2
https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories