Mediacms
Monthly
Broken authorization in MediaCMS 8.2.0 lets any authenticated user read private media metadata belonging to other users by injecting arbitrary media tokens into their own playlist. Because the playlist API skips ownership and state validation on PUT, an attacker who knows or guesses a target media token can then fetch their playlist and read otherwise-private fields (title, description, view/like counts, file size, author username, encoding status) via the unfiltered owner branch of the playlist detail view. No public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is reported as available.
Broken authorization in MediaCMS 8.2.0 lets any authenticated user read private media metadata belonging to other users by injecting arbitrary media tokens into their own playlist. Because the playlist API skips ownership and state validation on PUT, an attacker who knows or guesses a target media token can then fetch their playlist and read otherwise-private fields (title, description, view/like counts, file size, author username, encoding status) via the unfiltered owner branch of the playlist detail view. No public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is reported as available.