Executive brief
SeaCMS is a content management system used to host and deliver video content, including paywalled and VIP-restricted media. A vulnerability in the ass.php endpoint allows unauthenticated attackers to retrieve full playback URLs for protected videos without paying or logging in, exposing proprietary content and bypassing revenue controls.
Technical details
SeaCMS 13.6 contains a missing authorization check in ass.php that discloses video playback metadata and URLs regardless of payment or VIP status. The endpoint reads payment flags (v_money, v_vip) and calculates an isauth authorization status, but returns the complete video URL array before enforcing the authorization decision. An unauthenticated attacker can send a GET request to /ass.php with video ID parameters to retrieve full escaped playback URLs for paywalled content, even when the response marks the caller as unauthorized (isauth=n). No authentication or user interaction is required; the attack is purely network-based. The fix requires enforcing authorization checks before assembling or returning any protected media URLs.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory