Description

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T09:16:48.880Z",
  "pubdate": "2026-08-26T09:16:48.880Z",
  "executiveSummary": "A missing authentication vulnerability exists within CAYIN CMS-WS and CMS-SE, allowing unauthenticated remote attackers to bypass security controls. The vulnerability resides in specific application functionality that fails to validate user credentials before processing requests. By exploiting this flaw, an attacker can retrieve media file lists from the affected systems, leading to partial information disclosure. This exposure of internal data structures and file metadata provides reconnaissance opportunities for adversaries, potentially facilitating further attacks. The vulnerability is characterized by a lack of access control mechanisms on sensitive endpoints, requiring no prior authentication or privileged access to trigger. The risk is significant as it exposes internal assets to external entities over the network, compromising the confidentiality of system resources.",
  "technicalDetails": "The vulnerability is classified as a Missing Authentication flaw, where specific application functions within CAYIN CMS-WS and CMS-SE do not enforce session validation or identity verification. The root cause is the absence of an authentication check in the request handling logic for certain API endpoints or web interfaces responsible for managing and displaying media repository content.\nThe attack flow begins with a remote, unauthenticated actor interacting with the web service. The attacker identifies the specific URL paths or functions associated with media management that are erroneously exposed without requiring an active session token or administrative credentials. By sending crafted HTTP GET requests to these endpoints, the attacker can bypass the intended access control policies.\nUpon receiving the unauthorized request, the application backend processes the call as if it originated from an authorized user. The server-side logic then queries the database or file system to retrieve metadata, file lists, or organizational directory structures related to the media assets. The results are returned to the attacker in a structured format, such as JSON or XML, disclosing sensitive information about the file architecture, naming conventions, and file storage locations.\nThis vulnerability is particularly concerning because it allows an attacker to map the contents of the CMS environment without triggering standard authentication logs. Because the vulnerability exists at the network-exposed layer of the CMS-WS and CMS-SE applications, it is accessible to any attacker with network reach to the management interface. Post-exploitation, the disclosed information provides the attacker with a clear picture of the assets hosted on the server, which can be leveraged to identify more sensitive files, predict path structures for further enumeration, or conduct targeted social engineering based on the media content found.\nThe scope of impact is limited to information disclosure; however, the lack of authentication suggests a systemic failure in the implementation of the security middleware across the identified product lines. There are no known requirements for specific user privileges, as the vulnerability is explicitly triggered by the absence of the authentication handshake."
}