Authorization Vulnerability in AVideo by WWBN
CVE-2026-92586

5.3MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92586?

AVideo versions up to 29.0 fail to properly check permissions in the set_api_comment function. This issue allows authenticated users to post comments on videos that are protected by passwords or restricted to specific groups. Attackers can exploit this flaw by sending POST requests to the comment API endpoint with any video ID, thus bypassing access controls and potentially spamming content on videos they should not have access to.

Affected Version(s)

AVideo 0

AVideo 0 <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-f...
vendor-advisory
https://www.vulncheck.com/advisories/avideo-through-29.0-...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

santhreal
.