# CVE-2026-82602: SeaCMS authorization bypass in ass.php

Source: https://junglewise.ai/threats/cve-2026-82602-seacms-authorization-bypass-in-ass-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82602 · Severity: medium · CVSS 5.3 · Published 2026-08-31

SeaCMS is a content management system used to host and deliver video content, including paywalled and VIP-restricted media. A vulnerability in the ass.php endpoint allows unauthenticated attackers to retrieve full playback URLs for protected videos without paying or logging in, exposing proprietary content and bypassing revenue controls.

Technologies: [Seacms](https://junglewise.ai/threats/technologies/seacms). Vendors: [Seacms](https://junglewise.ai/threats/vendors/seacms).

## Quick answers

**Is CVE-2026-82602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82602 being exploited in the wild.

**How severe is CVE-2026-82602?** Medium severity, with a CVSS score of 5.3, published 31 August 2026.

**Which products and versions are affected?** Seacms up to 13.6.

**Is there a fix for CVE-2026-82602?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82602 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82602?** Check whether you run Seacms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SeaCMS 13.6 contains a missing authorization check in ass.php that discloses video playback metadata and URLs regardless of payment or VIP status. The endpoint reads payment flags (v_money, v_vip) and calculates an isauth authorization status, but returns the complete video URL array before enforcing the authorization decision. An unauthenticated attacker can send a GET request to /ass.php with video ID parameters to retrieve full escaped playback URLs for paywalled content, even when the response marks the caller as unauthorized (isauth=n). No authentication or user interaction is required; the attack is purely network-based. The fix requires enforcing authorization checks before assembling or returning any protected media URLs.

## Affected products

- SeaCMS SeaCMS up to 13.6

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: advisory

## References

- [https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md](https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md)
- [https://vuldb.com/cve/CVE-2026-82602](https://vuldb.com/cve/CVE-2026-82602)

## Related threats

- [SeaCMS SQL injection in comment API](https://junglewise.ai/threats/cve-2019-25778-seacms-through-8-7-contains-an-unauthenticated-sql-injection)
- [SeaCMS authenticated remote code execution in admin_config.php](https://junglewise.ai/threats/cve-2026-79423-seacms-authenticated-remote-code-execution-in-admin-config-php)
- [SeaCMS WeChat Module SQL injection via XML entity decoding](https://junglewise.ai/threats/cve-2026-85138-seacms-wechat-module-sql-injection-via-xml-entity-decoding)
- [SeaCMS Locoy Collector code injection via default password](https://junglewise.ai/threats/cve-2026-85137-seacms-locoy-collector-code-injection-via-default-password)
- [SeaCMS path traversal in member.php comment deletion](https://junglewise.ai/threats/cve-2026-82603-seacms-path-traversal-in-member-php-comment-deletion)