Description
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Brushfire | Online Experience | < 2026-02-26 | 2026-02-26 |
Advisories 1
- VA-26-232-01 Brushfire unauthenticated information disclosure CISA ICS & IT advisories · Aug 21, 2026