Executive brief
WWBN AVideo is a video streaming platform that includes an image gallery plugin feature. The ImageGallery endpoint fails to verify user permissions, allowing unauthenticated attackers to view filenames and download images from password-protected galleries without authentication. This exposes sensitive image collections that should be restricted to authorized users only.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the plugin/ImageGallery/list.json.php endpoint. The endpoint validates that the ImageGallery plugin is enabled and the video type is image, but fails to call User::canWatchVideo() to enforce password-protected gallery access controls. An unauthenticated attacker can send a GET request with a videos_id parameter to retrieve a JSON listing of gallery filenames and their direct URLs, then fetch the exposed files without authentication. The vulnerability affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. No patch was available at the time of advisory publication.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed: GitHub security advisory GHSA-vr35-39vf-9qp9 published
- 2026-09-12: advisory: CVE-2026-90548 published on NVD