SeaCMS CVE-2026-82602

The target must be running SeaCMS version 13.6 or earlier with the paywall or subscription-gated content feature active, and the /ass.php endpoint must be publicly reachable over the internet. No authentication, elevated privileges, or user interaction is required - the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms exploitation against internet-exposed default configurations. Exploitation is bounded by two concrete limiting factors: (1) the site must have the paywall feature configured and serving protected content URLs through /ass.php - deployments not using this monetization mechanism have no sensitive resource exposed at this endpoint; (2) impact is strictly confined to disclosure of content URLs, with no ability to modify data, execute code, escalate privileges, or affect system availability.

The CVSS 4.0 base score of 6.9 (Medium) with supplemental E:P reflects easy remote exploitability but a narrow blast radius: the VC:L cap (low confidentiality on the vulnerable system) confirms this is a URL disclosure issue rather than code execution or credential theft. A public proof-of-concept lowers the skill threshold for exploitation, but the absence of a CISA KEV listing indicates no confirmed mass or targeted exploitation at the time of analysis. EPSS data was not provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified beyond the POC signal. Realistic exposure is concentrated among SeaCMS operators who monetize content via the paywall feature - sites not using this functionality have no exploitable resource to disclose. The overall priority is low-to-moderate: the vulnerability warrants patching and interim access controls, but does not represent a systemic or infrastructure-level risk.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the publicly accessible /ass.php endpoint on a SeaCMS 13.6 instance, supplying a manipulated user-controlled key parameter to bypass the paywall authorization check. The server returns premium content URLs - such as direct video stream links - that should require a valid paid subscription, allowing the attacker to consume restricted content without payment. A public proof-of-concept on GitHub documents the precise request structure, reducing exploitation effort to a trivial replay.