CVE-2026-126545 · Other
NO FIX YET · SEE WHAT TO DO
AVideo through 29.7.1 has a missing authorization check in the tags API endpoint in plugin/API/API.php. A registered user who subscribes to a tag can read filenames, titles and stored video passwords of unlisted, group-restricted and password-protected videos.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
AVideo installations through 29.7.1 that allow registered users to log in and use the tags API. Sites where only administrators have accounts, or where the API is not exposed, have a smaller exposure. The sources do not say whether default configurations are affected.
Not affected if api-disabled, no-registered-users
Who cares avideo, php, self-hosted
29.7.1 and earlier are listed as affected.get_api_tags in plugin/API/API.php and confirm whether the tags API branch lacks an authorization check.29.7.1 (fixed version not stated in the sources).WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.