CVE-2026-92577

EUVD-2026-81277
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.74%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
wwbnavideo
𝑥
≤ 29.0
CNA
Common Weakness Enumeration
References
https://github.com/WWBN/AVideo/security/advisories/GHSA-w59h-5r8w-686r
https://www.vulncheck.com/advisories/avideo-through-29.0-api-get-api-video-broken-access-control-via-clean-title