Executive brief
AVideo is a video streaming platform that allows users to host and manage videos with access controls. A flaw in the API endpoint allows anonymous attackers to retrieve group-restricted videos and sensitive owner information (email, phone, address, birth date, admin status) by querying videos using their public URL slug. This bypasses group membership restrictions and exposes private user data.
Technical details
The vulnerability exists in the API::get_api_video() endpoint in plugin/API/API.php:1639, which has two branches for selecting videos: videos_id and clean_title. The clean_title branch calls Video::getVideoFromCleanTitle() with hardcoded parameters ($status="" and $ignoreGroup=true) that disable group-based access controls and skip the sensitive user field scrubber. Additionally, a shape bug in the sanitization loop (line 1740-1755) causes the loop to iterate over column values instead of rows, always triggering the continue statement before the removeSensitiveUserFields() call is reached. An unauthenticated attacker can query the API with a public video slug (clean_title) to retrieve restricted videos and their owner's PII, which is not scrubbed. The videos_id parameter path properly enforces access controls; only the clean_title path is affected. No patch is currently available.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-09-01: disclosed
- 2026-09-16: advisory