The Brushfire platform's video content streaming application exposes its database file path in response requests, enabling a remote, unauthenticated attacker to read information about other users. This results in the disclosure of potentially sensitive user data and violates confidentiality. The vulnerability is a classic example of CWE‑497, improper handling of sensitive data paths.

The affected product is Brushfire’s Online Experience video streaming application. No specific version information is listed, but the issue applies to the platform as available at https://online.brushfire.com.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not reported, and the vulnerability is not listed in the CISA KEV database, suggesting that widespread exploitation is not currently observed. However, the flaw allows unauthenticated remote exploitation: by issuing normal API requests to the streaming service, an attacker can obtain the database path and subsequently read user data. The flaw was fixed in February 2026, so any platform still running the affected code is at risk until patched.