{"id":"CVE-2026-126545","kind":"vulnerability","aliases":["CVE-2026-126545"],"related":[],"title":"WWBN AVideo: tags API leaks private video titles and passwords to users","description":"WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.","summary":"AVideo through 29.7.1 has a missing authorization check in the tags API endpoint in plugin/API/API.php. A registered user who subscribes to a tag can read filenames, titles and stored video passwords of unlisted, group-restricted and password-protected videos.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","other","php","self-hosted"],"not_affected_if":["api-disabled","no-registered-users"],"how_to_check":"- Check the installed AVideo version against the version range in the advisory: `29.7.1` and earlier are listed as affected.\n- Look for `get_api_tags` in `plugin/API/API.php` and confirm whether the tags API branch lacks an authorization check.","fix":"- Move to a release newer than `29.7.1` (fixed version not stated in the sources).","status":"open","published_at":"2026-11-11T01:17:16+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","triaged_at":"2026-11-11T01:25:55+00:00","updated_at":"2026-11-11T01:25:55+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T01:25:55Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than `29.7.1` (fixed version not stated in the sources).\n- unknown","reach":"internet","title":"WWBN AVideo: tags API leaks private video titles and passwords to users","impact":"medium","summary":"AVideo through 29.7.1 has a missing authorization check in the tags API endpoint in plugin/API/API.php. A registered user who subscribes to a tag can read filenames, titles and stored video passwords of unlisted, group-restricted and password-protected videos.","audience":"businesses","category":"other","nicknames":[],"who_cares":["avideo","self-hosted","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"private video passwords and titles readable by any registered user","analyst_note":"Confirm the fixed version and whether default installs expose the tags API, using the linked patch and vendor advisory on github.com.","how_to_check":"- Check the installed AVideo version against the version range in the advisory: `29.7.1` and earlier are listed as affected.\n- Look for `get_api_tags` in `plugin/API/API.php` and confirm whether the tags API branch lacks an authorization check.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-registered-users","api-disabled"],"who_is_affected":"AVideo installations through 29.7.1 that allow registered users to log in and use the tags API. Sites where only administrators have accounts, or where the API is not exposed, have a smaller exposure. The sources do not say whether default configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000755,"input_tokens":4648,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126545':15A,18A '-2026':14A,17A '29.7.1':27B,69C 'access':87C 'allow':83C 'api':4A,36B,76C,78C,95C 'apinam':104C 'attack':96C 'author':31B,73C 'avideo':2A,19B,25B,67C 'check':32B 'contain':70C 'cve':13A,16A 'data':90C 'enabl':125C 'endpoint':37B 'filenam':50B,108C 'get':77C 'group':59B,118C 'group-restrict':58B,117C 'host':24B 'leak':5A 'miss':30B,72C 'obtain':107C 'password':10A,55B,63B,113C,122C 'password-protect':62B,121C 'php':21B 'plugin/api/api.php':39B,81C 'privat':6A 'protect':64B,123C 'queri':92C,103C 'read':49B 'regist':41B,84C 'restrict':60B,88C,119C 'self':23B 'self-host':22B 'store':53B,111C 'subscrib':44B,98C 'tag':3A,35B,47B,79C,94C,101C,105C 'titl':8A,51B,109C 'unauthor':126C 'unlist':57B,116C 'user':12A,42B,85C 'valu':114C 'video':7A,54B,65B,89C,112C,124C 'view':127C 'vulner':74C 'wwbn':1A,66C","nicknames":[],"mitigations":[],"who_affected":"AVideo installations through 29.7.1 that allow registered users to log in and use the tags API. Sites where only administrators have accounts, or where the API is not exposed, have a smaller exposure. The sources do not say whether default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avideo","medium","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126545':15A,18A '-2026':14A,17A 'api':4A 'avideo':2A 'cve':13A,16A 'leak':5A 'password':10A 'privat':6A 'tag':3A 'titl':8A 'user':12A 'video':7A 'wwbn':1A","search_b":"'29.7.1':27B 'api':36B 'author':31B 'avideo':19B,25B 'check':32B 'endpoint':37B 'filenam':50B 'group':59B 'group-restrict':58B 'host':24B 'miss':30B 'password':55B,63B 'password-protect':62B 'php':21B 'plugin/api/api.php':39B 'protect':64B 'read':49B 'regist':41B 'restrict':60B 'self':23B 'self-host':22B 'store':53B 'subscrib':44B 'tag':35B,47B 'titl':51B 'unlist':57B 'user':42B 'video':54B,65B","search_c":"'29.7.1':69C 'access':87C 'allow':83C 'api':76C,78C,95C 'apinam':104C 'attack':96C 'author':73C 'avideo':67C 'contain':70C 'data':90C 'enabl':125C 'filenam':108C 'get':77C 'group':118C 'group-restrict':117C 'miss':72C 'obtain':107C 'password':113C,122C 'password-protect':121C 'plugin/api/api.php':81C 'protect':123C 'queri':92C,103C 'regist':84C 'restrict':88C,119C 'store':111C 'subscrib':98C 'tag':79C,94C,101C,105C 'titl':109C 'unauthor':126C 'unlist':116C 'user':85C 'valu':114C 'video':89C,112C,124C 'view':127C 'vulner':74C 'wwbn':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:39:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126545","severity":null,"published_at":"2026-11-11T01:17:16+00:00","modified_at":"2026-11-11T01:17:16+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","fetched_at":"2026-11-11T01:24:34+00:00","note":null}],"documents":[{"id":121303,"url":"https://github.com/WWBN/AVideo/commit/a8d1e0e484d655556422841d08b2b0fb64332721","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":121304,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T17:39:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":121305,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-get-api-tags-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}