MediaCMS version 8.2.0 contains an information disclosure vulnerability that allows authenticated users to access private media metadata of other users. This occurs because the playlist API endpoint lacks proper access control checks when adding media tokens, enabling attackers to bypass ownership validation. Exploitation involves issuing a PUT request with arbitrary media tokens to a playlist, then retrieving private fields such as title, description, view count, like count, file size, author username, and encoding status from the playlist details.