CVE-2026-49482 is a vulnerability in ClipBucket v5, an open source video sharing platform, caused by improper neutralization of SQL wildcard characters (CWE-155) in the subtitle editing endpoint. Authenticated users can exploit this by sending a % character as the number parameter, resulting in overwriting all subtitle titles of videos they own in a single HTTP request. The vulnerability affects versions prior to 5.5.3 and has been patched in version 5.5.3.

The vulnerability allows an authenticated user to modify subtitle titles of all videos they own by exploiting improper handling of wildcard characters. This leads to integrity loss of subtitle data but does not affect confidentiality or availability. The CVSS 3.1 base score is 4.3 (medium severity), reflecting limited impact confined to integrity with low attack complexity and no user interaction required.

Upgrade ClipBucket v5 to version 5.5.3 or later, where this vulnerability has been patched. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the version fix information.