AMERICAN ARCHIVE OF PUBLIC BROADCASTING FIXES BUG EXPOSING RESTRICTED MEDIA

Summary from the TLDR InfoSec newsletter

A vulnerability in the American Archive of Public Broadcasting website, which has been exploited since at least 2021, allowed unauthorized downloading of protected and private media through an insecure direct object reference (IDOR) flaw that bypassed access controls by manipulating media ID parameters. The exploit circulated in Discord preservation communities and "data hoarder" groups, leading to leaks of protected content, including a banned Sesame Street episode featuring the Wicked Witch of the West. AAPB fixed the vulnerability within 48 hours after being notified. The extent of accessed content during the years-long exploitation remains unknown.