Quick answers
- Is CVE-2026-82602 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82602 being exploited in the wild.
- How severe is CVE-2026-82602?
- Medium severity, with a CVSS score of 5.3, published 31 August 2026.
- Which products and versions are affected?
- Seacms up to 13.6.
- Is there a fix for CVE-2026-82602?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82602 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-82602?
- Check whether you run Seacms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
SeaCMS 13.6 contains a missing authorization check in ass.php that discloses video playback metadata and URLs regardless of payment or VIP status. The endpoint reads payment flags (v_money, v_vip) and calculates an isauth authorization status, but returns the complete video URL array before enforcing the authorization decision. An unauthenticated attacker can send a GET request to /ass.php with video ID parameters to retrieve full escaped playback URLs for paywalled content, even when the response marks the caller as unauthorized (isauth=n). No authentication or user interaction is required; the attack is purely network-based. The fix requires enforcing authorization checks before assembling or returning any protected media URLs.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory