Executive brief
AVideo is a self-hosted video streaming platform. An authorization flaw in the comment API allows any authenticated user to post comments on password-protected and group-restricted videos they cannot access, bypassing video access controls and potentially enabling harassment, spam, or unauthorized information disclosure through comments.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the set_api_comment function within plugin/API/API.php. The function verifies that the user can comment but fails to call User::canWatchVideo() or Video::verifyVideoPassword() before saving a comment, allowing authenticated users to bypass access controls. The attack vector is network-based with low complexity; an attacker only needs valid authentication credentials and can submit POST requests to /plugin/API/set.json.php?APIName=comment with an arbitrary videos_id parameter. The impact is limited to integrity (unauthorized comment posting) with no confidentiality or availability impact. No patch was available at the time of reporting (commit c3edcc274c389816d434acadac07ee78eaf330c1).
Affected products
- WWBN AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1)
Timeline
- 2026-09-16: disclosed
- 2026-09-01: advisory: GitHub Security Advisory GHSA-fm4f-q895-8jhc published