CVE-2026-75928
Received Received - Intake

Information Disclosure in Brushfire Video Streaming

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-75928
EUVD
EUVD-2026-63996

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
brushfire video_content_streaming_application to 2026 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Brushfire video content streaming application exposes database paths in requests to users. This allows unauthenticated remote attackers to read information about other users.

Impact Analysis

An attacker could access sensitive user data, including personal information or viewing history, without authorization. This could lead to privacy breaches or identity theft.

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by exposing unauthorized access to user data. Organizations could face legal penalties and reputational damage.

Mitigation Strategies

Update the Brushfire video content streaming application to the fixed version released in February 2026. Ensure the application no longer exposes database paths in user requests. Monitor network traffic for unauthorized access attempts to database paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75928. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart