The vulnerability in Fosowl AgenticSeek involves an authorization bypass through user-controlled keys in the ViewingStatusController component. Authenticated users can exploit this insecure direct object reference flaw to access and modify viewing status records belonging to other users without proper ownership checks. This enables unauthorized enumeration of watch progress, deletion of arbitrary viewing history, and manipulation of other users' Continue Watching dashboards.

An attacker with authenticated access can read and delete viewing status records of other users, potentially leading to privacy violations and disruption of user experience by altering watch progress and dashboard content. However, the vulnerability requires authentication and has a medium severity score (CVSS 5.3). There is no indication of remote code execution or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict authenticated user privileges where possible and monitor for suspicious activity related to viewing status modifications.