CVE-2026-34364

CVE-2026-34364 · AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no `?user=` parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the `?user=` parameter is supplied, a type confusion bug causes the filter to use the admin user's (user_id=1) group memberships instead of the current user's, rendering the filter ineffective. Commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9 contains a fix.

CVSS 5.3 · Mittel · EPSS 0,3%

Veröffentlicht

2026-03-27T18:11:05.866Z

Aktualisiert

2026-03-27T19:56:56.507Z

Technologie-Stack: php

Prüfen Sie Ihren Server →