CVE-2025-69415
Improper Access Control in Plex Media Server Allows Account Exposure
Publication date: 2026-01-02
Last updated on: 2026-02-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| plex | media_server | to 1.42.2.10156 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-672 | The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to account information or functionality via the /myplex/account endpoint, potentially exposing sensitive user data or allowing limited unauthorized actions. The CVSS score indicates a high impact on confidentiality and some impact on integrity.
Can you explain this vulnerability to me?
This vulnerability in Plex Media Server (PMS) through version 1.42.2.10156 allows access to the /myplex/account endpoint using a device token even when the device is not properly associated with an account. This means the access control based on device-account association is not correctly enforced.