CVE-2026-75928 in Online Experience
Summary
by MITRE • 08/21/2026
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within the Brushfire platform’s online video streaming service represents a critical failure in server-side input validation and access control mechanisms. Specifically, the application exposes internal database paths or identifiers directly through HTTP request parameters accessible to end-users without requiring authentication. This flaw allows any remote actor with network connectivity to the target system to manipulate these inputs, effectively bypassing standard security boundaries that should restrict data visibility to authorized users only. The exposure of such sensitive structural information is indicative of a deeper architectural issue where user-supplied data is not sufficiently sanitized or validated before being processed by backend systems, leading to unintended side effects in how resources are retrieved and served.
From a technical perspective, this vulnerability aligns with the Common Weakness Enumeration category CWE-209, which describes the generation of an error message that includes sensitive information about the environment. However, given the context where specific user data is accessible rather than just stack traces or configuration details, it also strongly correlates with CWE-611, Improper Restriction of XML External Entity References if XML parsing is involved, or more broadly with CWE-284, Improper Access Control. The core issue lies in the application's failure to enforce proper authorization checks on API endpoints that handle video content streaming requests. By exposing database paths, the system inadvertently reveals internal mapping logic and potentially direct object references (IDOR), which can be leveraged by attackers to enumerate valid user IDs or session tokens associated with other accounts.
The operational impact of this vulnerability is severe, primarily concerning confidentiality and integrity within the platform's ecosystem. An unauthenticated attacker can exploit these exposed paths to read information about other users, potentially including personally identifiable information (PII), viewing habits, subscription statuses, or private communication logs depending on what data is linked to those database entries. This capability undermines user trust and violates privacy regulations such as GDPR or CCPA if personal data is compromised. Furthermore, the ability to map internal structures facilitates further attacks, such as targeted phishing campaigns using harvested user details or more sophisticated injection attacks aimed at specific database records. The lack of authentication requirement means that this exploitation can be automated on a large scale, posing a significant risk to the entire user base rather than just isolated individuals.
To mitigate these risks and prevent similar vulnerabilities in future development cycles, immediate remediation efforts must focus on implementing robust access control policies across all API endpoints. Developers should ensure that every request for sensitive data undergoes strict authentication verification before any database queries are executed. Additionally, input validation mechanisms must be strengthened to reject or safely encode any user-supplied parameters that interact with backend storage systems, preventing the leakage of internal paths or identifiers. Adopting a principle of least privilege ensures that even if an endpoint is accessed, it only returns data relevant to the authenticated session owner. Regular security audits and penetration testing should also be conducted to identify similar exposure patterns in other parts of the application infrastructure. The fix implemented in February 2026 likely addresses these gaps by enforcing stricter request filtering and ensuring that database interactions are abstracted away from direct user input, thereby closing the attack vector entirely.