Incomplete API Sanitization in AVideo Leads to Unauthorized Data Exposure

CVE-2026-88875

What is CVE-2026-88875?

AVideo has a significant vulnerability where the API's incomplete sanitization of sensitive user fields allows low-privilege authenticated users to gain unauthorized access to other users' videos. The issue arises because the API does not adequately restrict access to sensitive user data, including email addresses and account flags. This vulnerability is particularly concerning as it can lead to unauthorized disclosure of personal information without any proper access controls or condition checks against the API user's privileges. As there was no patched version available when the advisory was published, users and administrators must be vigilant about their data security practices when using AVideo.

References