CVE-2026-65054

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-65054

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65054.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-65054

Published

2026-07-21T20:28:30Z

Modified

2026-10-02T03:30:54Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole

Details

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API endpoint with a known media token to bypass state and ownership validation, then retrieve the playlist to read private media fields including title, description, view count, like count, file size, author username, and encoding status through the unfiltered playlist owner branch in the playlist detail view.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65054.json"
}

References

Affected packages

Git / github.com/mediacms-io/mediacms

Affected ranges

Type

GIT

Repo

https://github.com/mediacms-io/mediacms

Events

Introduced

51b1097509fdbb6d2d0dd543475a2f084b5df6bf

Last Affected

51b1097509fdbb6d2d0dd543475a2f084b5df6bf

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "8.2.0"
        },
        {
            "last_affected":  "8.2.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

8.*

8.2.0

v8.*

v8.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65054.json"