CVE-2025-32945 PeerTube Arbitrary Playlist Creation via REST API
An authenticated user can create playlists in another user's channel by bypassing ownership checks in the REST API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32945?
CVE-2025-32945 is a medium-severity missing authorization vulnerability in framasoft:peertube, published on 15 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
Weakness: CWE-282
Which versions are affected by CVE-2025-32945?
It affects 1 product.
Products include Framasoft Peertube.
How do I fix CVE-2025-32945?
No fix has been published for CVE-2025-32945 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-32945 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32945 exists.
Other vulnerabilities in framasoft:peertube
- CVE-2022-0881 Insecure Storage of Sensitive Information in chocobozzz/peertube
- CVE-2021-3780 Cross-site Scripting (XSS) - Stored in chocobozzz/peertube
- CVE-2025-32947 PeerTube ActivityPub Crawl Infinite Loop DoS
- CVE-2025-32948 PeerTube ActivityPub Playlist Creation Blind SSRF and DoS
- CVE-2025-32944 PeerTube User Import Authenticated Persistent Denial of Service
Sources
Also known as GHSA-9gxm-gppf-g7cc.