EUVD-2026-46408
GHSA-363p-gjpv-2pxq
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated user issues a network API request (PR:L, AV:N), attack is a simple PUT so AC:L, and impact is disclosure of private metadata only (C:H, I:N, A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API endpoint with a known media token to bypass state and ownership validation, then retrieve the playlist to read private media fields including title, description, view count, like count, file size, author username, and encoding status through the unfiltered playlist owner branch in the playlist detail view.
AnalysisAI
Broken authorization in MediaCMS 8.2.0 lets any authenticated user read private media metadata belonging to other users by injecting arbitrary media tokens into their own playlist. Because the playlist API skips ownership and state validation on PUT, an attacker who knows or guesses a target media token can then fetch their playlist and read otherwise-private fields (title, description, view/like counts, file size, author username, encoding status) via the unfiltered owner branch of the playlist detail view. No public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is reported as available.
Technical ContextAI
MediaCMS is an open-source Django-based video and media content management system used to run self-hosted video portals. The root cause is CWE-863 (Incorrect Authorization): the playlist update endpoint accepts a media token via PUT and attaches the referenced media to the caller's playlist without verifying that the caller is permitted to view that media, effectively conflating 'owns the playlist' with 'may see this media's metadata.' The playlist detail view then renders media through a code path intended for the playlist owner that does not re-apply per-media privacy filtering, so private records are serialized in full. The affected product per CPE is cpe:2.3:a:mediacms:mediacms (all versions matching, with 8.2.0 explicitly identified in the report).
RemediationAI
Patch available per vendor advisory - upgrade MediaCMS from 8.2.0 to the fixed release published by the maintainers at https://github.com/mediacms-io/mediacms (exact fixed version number is not stated in the provided data and should be confirmed against issue https://github.com/mediacms-io/mediacms/issues/1548 and the tagged releases before deploying). If immediate patching is not possible, apply compensating controls: enforce server-side ownership/visibility checks on the playlist PUT endpoint so a media token cannot be attached unless the requester is authorized to view it, and add per-media privacy filtering to the playlist detail serializer's owner branch; at the deployment layer, restrict or rate-limit access to the playlist API to slow token guessing and, where feasible, limit account creation to trusted users to reduce the pool of authenticated attackers. The trade-off of restricting playlist API access is degraded functionality for legitimate users, and account-creation limits reduce the openness of a public media portal.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today