CVE-2026-80234

Deferred Deferred - Pending Action

Missing Authentication in CAYIN CMS-WS and CMS-SE

Publication date: 2026-08-26

Last updated on: 2026-09-03

Assigner: TWCERT/CC

Description

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-03

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80234

EUVD

EUVD-2026-66343

Affected Vendors & Products

Vendor	Product	Version / Range
cayin_technology	cayin_cms_ws	*
cayin_technology	cayin_cms_se	*
cayin_technology	cayin_cms_ws	to 1.0.26198 (exc)
cayin_technology	cayin_cms_se	to 11.0.26198 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CAYIN CMS-WS and CMS-SE software have a Missing Authentication vulnerability. Unauthenticated remote attackers can access media file lists through specific functions, resulting in partial information disclosure.

Detection Guidance

Check if your CAYIN CMS-WS or CMS-SE versions are 1.0.25336 or earlier for CMS-WS and 11.0.25336 or earlier for CMS-SE. Use commands like 'curl -v http://[target]/[vulnerable_path]' to test for unauthenticated access to media file lists.

Impact Analysis

An attacker could exploit this to view media file lists without authentication, potentially exposing sensitive information about stored media files.

Compliance Impact

This vulnerability allows unauthenticated remote attackers to access media file lists, which could lead to unauthorized disclosure of sensitive information. For GDPR, this may violate principles of data confidentiality and integrity (Article 5). For HIPAA, it could result in unauthorized access to protected health information, breaching the Security Rule requirements.

Mitigation Strategies

Update CAYIN CMS-WS to version 1.0.26198 or later and CMS-SE to version 11.0.26198 or later. If updates are unavailable, restrict network access to the vulnerable systems until patched.

Hi! I’m here to help you understand CVE-2026-80234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70