This vulnerability, identified as CVE-2026-65543, affects Vimeo software versions up to 1.2.2. It involves the insertion of sensitive subscriber information into data that is sent, which could lead to exposure of this sensitive data. The CVSS v3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. The vulnerability is categorized under CWE-201 (Insertion of Sensitive Information Into Sent Data). There is no vendor advisory or patch available, and the product is not a cloud service, so remediation is not managed by the vendor.

The vulnerability allows sensitive subscriber data to be exposed through data sent by the affected Vimeo software, potentially compromising subscriber privacy. The confidentiality impact is high, but there is no impact on integrity or availability. Since the attack vector is network-based and requires no privileges or user interaction, the vulnerability could be exploited remotely if an attacker can intercept or access the sent data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users of affected Vimeo versions should monitor vendor communications for updates. Until a patch is released, minimizing exposure of sensitive subscriber data in transit and restricting network access to the affected software may reduce risk.