rootpwn

high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-92577

AVideo CMS versions up to 29.0 expose a broken access control flaw in the get_api_video endpoint. Anonymous callers can query videos by publ

Overview

AVideo CMS versions up to 29.0 expose a broken access control flaw in the get_api_video endpoint. Anonymous callers can query videos by public slug and receive owner PII such as email, phone, address, birth date, and admin status.

Description

In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.

Impact

Confidentiality of user PII is compromised for all video owners. No direct integrity or availability impact is reported, but the data exposure could enable social engineering or credential misuse.

Remediation

['Upgrade to the latest AVideo CMS release (≥30.0) where the access control bug is fixed.', 'If upgrading is not immediately possible, restrict the get_api_video endpoint to authenticated users and enforce group membership checks before returning any PII.', 'Apply input validation to ensure only authorized slugs are processed, and sanitize responses to exclude sensitive fields for anonymous requests.', 'Monitor API logs for abnormal access patterns and block suspicious IPs.']

Risk context

High severity (CVSS v3 7.5, v4 8.7) indicates a significant confidentiality risk. Prompt patching or mitigation is recommended to prevent PII leakage.

Affected products

  • AVideo CMS 29.0
  • AVideo CMS <=29.0

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS
—

access-control PII AVideo API confidentiality high-severity

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis