PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65054 MediaCMS CVE debrief

CVE-2026-65054 is an information disclosure vulnerability in MediaCMS 8.2.0. Authenticated users can expose private media metadata by adding arbitrary media tokens to their playlist, bypassing access control checks. This allows retrieval of private media fields such as title, description, view count, like count, file size, author username, and encoding status.

Vendor
MediaCMS
Product
Unknown
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

MediaCMS 8.2.0 users and administrators should be aware of this vulnerability. Authenticated users with access to the playlist API can potentially exploit this issue to access private media metadata of other users.

Technical summary

The vulnerability exists in the MediaCMS 8.2.0 playlist API endpoint. An attacker can issue a PUT request with a known media token to bypass validation, then retrieve the playlist to read private media fields such as title, description, view count, like count, file size, author username, and encoding status. This is possible due to a lack of access control checks when adding media tokens to a user's playlist. The issue allows authenticated users to expose private media metadata by adding arbitrary media tokens to their playlist, bypassing access control checks. To address this, users and administrators should be aware of this vulnerability and take steps to protect their systems.

Defensive priority

High priority due to the high CVSS score of 8.2 and the potential for authenticated users to access sensitive information.

Recommended defensive actions

  • Immediately update MediaCMS to a version that patches this vulnerability, if available.
  • Implement additional access controls and validation checks for media tokens and playlist modifications.
  • Monitor and audit API requests to the playlist endpoint for suspicious activity.
  • Consider temporarily disabling the playlist feature or restricting access to it until a patch is applied.
  • Enhance logging and exception tracking for media-related API calls.

Evidence notes

The CVE record was published on 2026-07-21T21:16:54.020Z and last modified on 2026-07-22T16:18:51.170Z. The NVD entry is currently Received. References include the official CVE record, NVD detail, and source references from Vulncheck.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-65054 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-65054

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-65054 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-65054

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.