Missing Authorization in WWBN AVideo Allows Unauthorized Media Access

CVE-2026-126809

What is CVE-2026-126809?

WWBN AVideo versions up to 29.7.1 are affected by a missing authorization vulnerability located in the objects/import.json.php file. This flaw permits malicious users to import MP4 files from other users by referencing any folder within the videos directory. Consequently, attackers may gain access to private, unlisted, password-protected, or pay-per-view videos. In addition, this vulnerability enables them to read associated .txt or .html files as descriptions, enumerate files through objects/listFiles.json.php, and delete victims' media using a specific delete parameter. Prompt attention to this issue is recommended to mitigate potential data breaches.

References