CVE-2026-65054: MediaCMS Information Disclosure Flaw

CVE-2026-65054 Overview

CVE-2026-65054 is an authorization flaw in MediaCMS 8.2.0 that allows authenticated users to disclose private media metadata belonging to other accounts. The vulnerability resides in the playlist API, which fails to validate ownership when a user adds arbitrary media tokens to their own playlist. An attacker with a valid account and knowledge of a target media token can issue a PUT request to attach that item to their playlist, then retrieve the playlist detail view to read private metadata. Exposed fields include title, description, view count, like count, file size, author username, and encoding status. The flaw is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers can enumerate and read private media metadata across the MediaCMS instance without any interaction from the target user.

Affected Products

MediaCMS 8.2.0
MediaCMS instances exposing the playlist API endpoint
Deployments relying on private media visibility controls

Discovery Timeline

2026-07-21 - CVE-2026-65054 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65054

Vulnerability Analysis

MediaCMS represents media items with tokens and allows users to organize them into playlists. The playlist update handler accepts a media token in a PUT request and appends the referenced item without verifying that the requesting user has view rights to the target media. Once the private item is attached, the playlist detail view iterates over playlist entries and, in the playlist owner branch, returns full metadata for every item regardless of the underlying media privacy setting. The vulnerability requires only a valid authenticated session and a known media token, which can be enumerated or leaked from other channels. Successful exploitation compromises confidentiality of private media assets, though integrity and availability are not directly affected.

Root Cause

The root cause is missing authorization enforcement in the playlist item association logic. The application trusts playlist ownership as a proxy for read access to every contained media object. Because tokens serve as identifiers rather than capability credentials, the server must independently validate that the requester can view each referenced media item before disclosing its metadata.

Attack Vector

Exploitation follows a two-step network sequence. The attacker first sends a PUT request to the playlist API endpoint, supplying a target media token to add the private item to a playlist they own. The attacker then issues a GET request against the playlist detail endpoint. The playlist owner branch of the detail view serializes the associated media, returning private fields such as title, description, views, likes, size, user.username, and encoding_status. No privilege escalation or victim interaction is required.

See the VulnCheck Advisory on MediaCMS and GitHub Issue #1548 Discussion for additional technical context.

Detection Methods for CVE-2026-65054

Indicators of Compromise

PUT requests to the MediaCMS playlist API containing media tokens the requester did not upload or previously access.
Repeated GET requests to /api/v1/playlists/{id} returning metadata for media flagged as private in the database.
Accounts adding unusually large numbers of unrelated media items to a single playlist within a short window.

Detection Strategies

Correlate playlist mutation events with the privacy state of referenced media in application logs to flag ownership mismatches.
Deploy application-layer rules that alert when a playlist add operation references media tokens outside the requesting user's ownership scope.
Baseline normal playlist size and modification cadence per user, then alert on statistical outliers.

Monitoring Recommendations

Enable verbose logging on the MediaCMS playlist and media APIs, capturing user ID, media token, and response payload size.
Forward web server and application logs to a centralized analytics platform for retention and query.
Review authentication and session logs alongside playlist activity to identify credential-stuffed or newly created accounts probing media tokens.

How to Mitigate CVE-2026-65054

Immediate Actions Required

Restrict access to the MediaCMS instance to trusted users until an upstream patch is applied.
Audit existing playlists for private media items owned by other users and revoke exposed associations.
Rotate any media tokens tied to sensitive uploads that may have been enumerated.

Patch Information

At the time of publication, no fixed release was referenced in the NVD entry. Monitor the GitHub Repository for MediaCMS and the tracking GitHub Issue #1548 Discussion for an official patch. Once available, upgrade all MediaCMS deployments to the fixed version and validate that playlist item association enforces per-media view permissions.

Workarounds

Apply a reverse-proxy or WAF rule that blocks or requires elevated review for PUT requests to the playlist API when the referenced media token is not owned by the session user.
Temporarily disable the playlist feature or restrict it to trusted user groups if compensating controls cannot be deployed.
Enforce stricter account provisioning, including email verification and rate limiting, to raise the cost of automated token enumeration.

bash

# Example nginx rule to log and inspect playlist PUT requests for later review
location ~ ^/api/v1/playlists/[0-9]+$ {
    if ($request_method = PUT) {
        access_log /var/log/nginx/mediacms_playlist_put.log combined;
    }
    proxy_pass http://mediacms_backend;
}