CVE-2026-49202
Loose CORS Policy Exposes Unauthenticated Media Archives
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: 8fc372e3-d9c5-46e4-9410-38469745c639
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves internal multimedia session archives being accessible without requiring authentication. Additionally, the issue is worsened by overly permissive Cross-Origin Resource Sharing (CORS) rules, which allow these archives to be stolen across different websites.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access and theft of internal multimedia session data. Because no authentication is required, attackers can easily retrieve sensitive multimedia information. The loose CORS policies further enable cross-site attacks, increasing the risk of data exposure and potential misuse.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows internal multimedia session archives to be accessed without authentication, combined with loose Cross-Origin Resource Sharing (CORS) rules that enable cross-site data theft.
Such unauthorized access and potential data exfiltration could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.
Therefore, this vulnerability may negatively impact compliance by exposing sensitive data to unauthorized parties.