This vulnerability, identified as CVE-2026-65543, affects Vimeo versions <= 1.2.2 and involves the insertion of sensitive subscriber information into data sent by the application. The issue is categorized under CWE-201, which pertains to the insertion of sensitive information into sent data, potentially exposing subscriber data to unauthorized parties. The CVSS v3.1 score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability can lead to the exposure of sensitive subscriber information to unauthorized entities, compromising confidentiality. There is no reported impact on data integrity or availability. The high CVSS score reflects the potential for remote exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users of affected Vimeo versions should consider limiting exposure of sensitive subscriber data and monitor for updates from the vendor.