Executive brief
AVideo is a self-hosted video platform that provides APIs for accessing video metadata. The vulnerability allows any authenticated user to request another user's video through the API and receive sensitive information including the video owner's email address, username, and permission flags (admin status, upload/streaming capabilities). This information is normally hidden from unauthenticated guests and should only be visible to the owner or API callers with a valid secret.
Technical details
This is an incomplete implementation of input sanitization in the API::get_api_video() function. The vulnerable code in plugin/API/API.php removes sensitive user fields (email, username, isAdmin, canUpload, canStream) from video API responses only when the caller is unauthenticated or lacks a valid API secret. However, it fails to check whether the authenticated caller actually owns the video being requested. The get_api_video() method joins user table columns into video rows but compares authentication status rather than comparing User::getId() with the row's users_id, treating any logged-in account as if they own every joined user record. An attacker with any authenticated account can call the APIName=video endpoint with another user's video ID to extract owner PII and security flags. No patched version was available at the time of advisory publication.
Affected products
- WWBN AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23)
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory GHSA-qwp4-vh4w-2fh9 published
- 2026-09-10: advisory: CVE-2026-88875 published on NVD