CVE-2025-32946 PeerTube Arbitrary Playlist Creation via ActivityPub Protocol
Attackers can create playlists in other users' channels via ActivityPub due to missing ownership validation, requiring a patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32946?
CVE-2025-32946 is a medium-severity missing authorization vulnerability in framasoft:peertube, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
Weakness: CWE-282
Which versions are affected by CVE-2025-32946?
It affects 1 product.
Products include Framasoft Peertube.
How do I fix CVE-2025-32946?
No fix has been published for CVE-2025-32946 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-32946 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32946 exists.
Other vulnerabilities in framasoft:peertube
- CVE-2022-0881 Insecure Storage of Sensitive Information in chocobozzz/peertube
- CVE-2021-3780 Cross-site Scripting (XSS) - Stored in chocobozzz/peertube
- CVE-2025-32947 PeerTube ActivityPub Crawl Infinite Loop DoS
- CVE-2025-32948 PeerTube ActivityPub Playlist Creation Blind SSRF and DoS
- CVE-2025-32944 PeerTube User Import Authenticated Persistent Denial of Service
Sources
Also known as GHSA-6f46-45q7-4jx2.