PatchSiren cyber security CVE debrief
CVE-2026-65054 MediaCMS CVE debrief
CVE-2026-65054 is an information disclosure vulnerability in MediaCMS 8.2.0. Authenticated users can expose private media metadata by adding arbitrary media tokens to their playlist, bypassing access control checks. This allows retrieval of private media fields such as title, description, view count, like count, file size, author username, and encoding status.
- Vendor
- MediaCMS
- Product
- Unknown
- CVSS
- HIGH 8.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
MediaCMS 8.2.0 users and administrators should be aware of this vulnerability. Authenticated users with access to the playlist API can potentially exploit this issue to access private media metadata of other users.
Technical summary
The vulnerability exists in the MediaCMS 8.2.0 playlist API endpoint. An attacker can issue a PUT request with a known media token to bypass validation, then retrieve the playlist to read private media fields such as title, description, view count, like count, file size, author username, and encoding status. This is possible due to a lack of access control checks when adding media tokens to a user's playlist. The issue allows authenticated users to expose private media metadata by adding arbitrary media tokens to their playlist, bypassing access control checks. To address this, users and administrators should be aware of this vulnerability and take steps to protect their systems.
Defensive priority
High priority due to the high CVSS score of 8.2 and the potential for authenticated users to access sensitive information.
Recommended defensive actions
- Immediately update MediaCMS to a version that patches this vulnerability, if available.
- Implement additional access controls and validation checks for media tokens and playlist modifications.
- Monitor and audit API requests to the playlist endpoint for suspicious activity.
- Consider temporarily disabling the playlist feature or restricting access to it until a patch is applied.
- Enhance logging and exception tracking for media-related API calls.
Evidence notes
The CVE record was published on 2026-07-21T21:16:54.020Z and last modified on 2026-07-22T16:18:51.170Z. The NVD entry is currently Received. References include the official CVE record, NVD detail, and source references from Vulncheck.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T21:16:54.020Z and has not been modified since then. The NVD entry is currently Received.