CVE-2026-65054 Details

An information disclosure vulnerability exists in MediaCMS version 8.2.0, allowing authenticated users to access private media metadata of other users. This is achieved by adding arbitrary media tokens to their own playlist without proper access control. Exploitation involves sending a PUT request to the playlist API with a known media token, bypassing ownership validation. The vulnerable playlist detail view then exposes private metadata such as the media title, description, view count, like count, file size, author username, and encoding status. However, the actual media stream remains protected by an Nginx authentication layer.