Improper Authentication in Vimeo's API 'versions' endpoint.

Summary

The versions endpoint was exploitable by accounts that were not pro or business.

Issue

There was an authorization issue in versions endpoint, Which on exploiting could allow an attacker to leak private videos of pro/business users due to the fact version is only applicable for pro/business accounts.

Impact

Making a crafted request will result in VICTIM_VIDEO_VERSION to be MOVED from victim's video to current version of attacker's video. On playing attacker video's victim's video will be played.