CVE-2025-32946: Framasoft PeerTube Auth Bypass Flaw

CVE-2025-32946 Overview

CVE-2025-32946 affects Framasoft PeerTube, a federated video hosting platform built on the ActivityPub protocol. The vulnerability allows an unauthenticated attacker to create playlists inside another user's channel. The vulnerable code path sets the playlist owner to the requesting user but assigns the channel ID from the incoming request without verifying channel ownership. This missing authorization check falls under [CWE-282] (Improper Ownership Management). Framasoft addressed the issue in PeerTube release v7.1.1.

Critical Impact
Attackers can inject arbitrary playlists into channels belonging to other users on any PeerTube instance, undermining content integrity across the federated network.

Affected Products

Framasoft PeerTube versions prior to 7.1.1
PeerTube instances exposing the ActivityPub federation endpoints
Federated servers that accept remote playlist activities

Discovery Timeline

2025-04-15 - CVE-2025-32946 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32946

Vulnerability Analysis

PeerTube is a decentralized video platform that uses ActivityPub to federate content between instances. The vulnerability lives in the playlist creation handler exposed through the ActivityPub protocol. When a request arrives to create a playlist, the server records the requesting user as the playlist owner. It then assigns the playlist to a channel using the channelId supplied by the requester. The handler never confirms that the target channel actually belongs to the requesting user.

This flaw enables cross-user content injection. An attacker can populate victim channels with attacker-controlled playlists, potentially including misleading titles, links, or references to inappropriate videos. Because the abuse occurs over ActivityPub, it can propagate across federated instances, expanding the blast radius beyond a single server.

Root Cause

The root cause is missing ownership validation in the playlist creation logic. The code correctly binds the owner field to the authenticated actor but treats the channel identifier from the request as trusted. Proper access control requires verifying that the requester owns the channel referenced by channelId before persisting the playlist relationship.

Attack Vector

The attack occurs over the network using the ActivityPub protocol. No authentication on the target instance is required beyond what ActivityPub federation permits, and no user interaction is needed. An attacker crafts an ActivityPub request that specifies a channelId owned by another user. The server accepts the request and links the new playlist to the victim's channel.

Refer to the JFrog Vulnerability Analysis: PeerTube for the technical write-up describing the vulnerable code path.

Detection Methods for CVE-2025-32946

Indicators of Compromise

Playlists appearing in a channel whose creator differs from the channel owner
ActivityPub inbox entries containing playlist creation activities referencing channel IDs that do not match the sending actor
Unexpected federation traffic targeting the playlist creation endpoint from unfamiliar remote instances

Detection Strategies

Audit the PeerTube database for playlists where ownerAccountId does not match the owner of the associated videoChannelId
Review web server and application logs for ActivityPub Create activities targeting playlist objects from non-local actors
Correlate playlist creation timestamps with account activity to identify programmatic abuse

Monitoring Recommendations

Enable verbose logging for ActivityPub inbox handlers to capture actor and target channel identifiers
Alert on spikes in playlist creation volume, particularly from federated peers
Track newly created playlists per channel and flag rates that deviate from historical baselines

How to Mitigate CVE-2025-32946

Immediate Actions Required

Upgrade PeerTube to version 7.1.1 or later on all instances
Enumerate existing playlists and remove any created by an account that does not own the parent channel
Notify federated peers that have not upgraded and consider temporarily restricting federation with them

Patch Information

Framasoft released the fix in PeerTube v7.1.1. The patch adds ownership validation so the server rejects playlist creation requests whose supplied channel is not owned by the requesting actor. Administrators should follow the standard PeerTube upgrade procedure and restart the service after applying the update.

Workarounds

If immediate patching is not possible, restrict ActivityPub federation to a trusted allowlist of instances
Disable remote playlist creation at the reverse proxy layer by filtering ActivityPub activities targeting the playlist endpoint
Increase administrative review of new playlists until the instance is patched

bash

# Configuration example: upgrade PeerTube to the patched release
cd /var/www/peertube
sudo -u peertube git fetch --tags
sudo -u peertube git checkout v7.1.1
sudo -u peertube yarn install --production --pure-lockfile
sudo systemctl restart peertube