Kyoo EUVD-2026-83204

Requires an authenticated Kyoo account that has been granted the core.play permission - this is the gating prerequisite and rules out anonymous/unauthenticated exploitation. The attacker must also know or successfully guess the target file's path, and that file must reside beneath the configured media SafePath directory. Only affects Kyoo versions prior to 5.1.0. Impact is limited to reading uncataloged files (hidden, temporary, operational, or otherwise not represented by a Kyoo catalog record); it does not grant access outside the SafePath tree, nor any write/modify or denial-of-service capability. These constraints (valid privileged account plus path knowledge, read-only, subtree-confined) meaningfully limit realistic exploitation beyond the raw score.

This is a genuine but modest-severity authorization flaw (CWE-639 IDOR/BOLA), not a high-priority emergency. All signals align on limited risk: the vendor CVSS 3.1 base score is 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable and low-complexity, but requiring an authenticated account (PR:L) that holds the core.play permission, and yielding only low confidentiality impact with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The impact is inherently bounded: an attacker can read only uncataloged files that reside beneath the already-configured media SafePath, and only when the path is known or guessed, which further caps real-world confidentiality loss. Note the input Tag 'Authentication Bypass' is inaccurate - this is an authorization/access-control failure (the user is already authenticated), so severity/triage should be read as an IDOR, not an auth bypass. Overall this is a low-to-medium priority defense-in-depth fix rather than an urgent externally-exploitable RCE-class issue.

A registered Kyoo user holding the core.play permission base64-encodes a filesystem path pointing at a hidden, temporary, or operational file located beneath the media SafePath, then submits it to the transcoder streaming endpoint. Because the server only validated the SafePath prefix and never confirmed the path corresponds to a real Kyoo catalog record, it serves the uncataloged file's contents back to the attacker. No public exploit code is identified, but the technique is straightforward given the authenticated low-complexity network vector (AV:N/AC:L).