CVE-2026-82602
Received Received - Intake

Authorization Bypass in SeaCMS

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82602
EUVD
EUVD-2026-68311

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in SeaCMS up to version 13.6. It allows remote attackers to access protected media URLs without authentication by exploiting the ass.php file. The issue occurs because authorization checks are not enforced before returning sensitive video URLs.

Detection Guidance

To detect this vulnerability, check if unauthorized users can access /ass.php with parameters like vid, vfrom, and vpart. Send a crafted GET request to /ass.php and verify if it returns protected media URLs without authentication. Example: curl -X GET 'http://example.com/ass.php?vid=123&vfrom=456&vpart=789'

Monitor server logs for unusual requests to /ass.php with these parameters. Ensure the response does not expose sensitive video URLs to unauthorized users.

Impact Analysis

An attacker could retrieve paywalled or VIP content URLs without paying or authenticating. This exposes protected media, bypasses revenue controls, and may lead to unauthorized access to premium content. The impact includes financial loss for content providers and potential privacy risks if sensitive media is exposed.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA if it leads to unauthorized access to sensitive or personal media content. Organizations could face compliance penalties for failing to protect user data and access controls.

Mitigation Strategies

Immediately update SeaCMS to the latest version beyond 13.6 to patch the vulnerability. If an update is unavailable, restrict access to /ass.php via server configuration or firewall rules.

Review and enforce strict authorization checks in ass.php to prevent unauthorized access to protected media URLs. Disable direct access to sensitive endpoints if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart