Information Disclosure in WWBN AVideo Versions Prior to 30.0
CVE-2026-81732

6.9MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
28 August 2026

What is CVE-2026-81732?

AVideo prior to version 30.0 is susceptible to an information disclosure vulnerability that allows unauthorized users to access sensitive user registration statistics. This issue arises due to insufficient authentication controls on the report4.json.php and report4.1.json.php endpoints. Attackers can exploit this vulnerability by sending unauthenticated GET requests to retrieve both daily and cumulative counts of user registrations, potentially leading to unauthorized exposure of user data.

Affected Version(s)

AVideo 0 <= 30.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-x...
vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-through-...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

skeletonsec
.