CVE-2026-34364

CVE-2026-34364 · AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no `?user=` parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the `?user=` parameter is supplied, a type confusion bug causes the filter to use the admin user's (user_id=1) group memberships instead of the current user's, rendering the filter ineffective. Commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9 contains a fix.

CVSS 5.3 · Medium · EPSS 0.3%

Published

2026-03-27T18:11:05.866Z

Updated

2026-03-27T19:56:56.507Z

Stack: php

Check your server →