This vulnerability earns a CVSS 5.4, but the score badly misrepresents the actual risk. The issue isn't simply that an authenticated user can comment on private videos—it's that the system's response to unauthorized comments creates a deterministic enumeration oracle. When you POST to the comment endpoint with a random videoId, you get one of two outcomes: an error (the video doesn't exist or you can't access it), or the system processes the comment and fires a notification email to the video owner. That email is observable feedback confirming the video exists and is accessible to someone who shouldn't have that knowledge.
This transforms the vulnerability from a simple IDOR into a scalable attack primitive. An attacker scripts enumeration across video IDs, observing which attempts trigger confirmation emails. The comment injection itself is almost incidental—the real value is the side-channel. Impact scales with your video collection size; a system with millions of private videos offers millions of potential targets, limited only by rate controls on the comment endpoint.
The notification trigger also enables denial-of-service through comment flooding against video owners, a vector the CVSS temporal metrics don't capture.
The correct fix requires addressing both the authorization gap AND the notification system's trust model. Adding authorization checks to the comment endpoint while leaving the notification service unchanged still permits the oracle if any other path to comment creation exists. Conversely, rate-limiting notifications without fixing authorization still allows comment injection. Both components must be hardened—a durable fix must ensure the notification system doesn't assume successful comment creation implies legitimate access.
The CVSS 5.4 scores the IDOR in isolation, ignoring that the actual exploitability only emerges from the intersection of two independently reasonable design decisions. This compound pattern has CVE genealogy spanning fifteen years, consistently landing in the 4-6 range because assessors price the access control failure, not the side-channel. Organizations using CVSS-based prioritization will deprioritize this to a 90-day window, precisely because standard scanners won't surface the enumeration oracle. The scoring normalizes the risk, normalization drives deprioritization, and the compound exploitability—harder to detect—gets priced by attackers, not defenders.