CVE-2026-92577

AVideo through version 29.0 contains a broken access control flaw (CWE-639) in the get_api_video API endpoint, specifically in its clean_title branch. An unauthenticated attacker can look up any video by its publicly visible slug, causing the endpoint to skip user-group authorization checks and return videos that should be restricted to members of specific groups. The response also leaks sensitive fields about the video owner, including email address, phone number, physical address, birth date, and whether the account is an administrator. Any AVideo deployment running version 29.0 or earlier with the API reachable (the default configuration) is affected, and the confidentiality-only impact makes it useful for reconnaissance and PII harvesting. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and there are no confirmed reports of exploitation so far.

What to do: Upgrade AVideo to the latest release from the vendor (anything newer than 29.0) as soon as a patched build is available. Until then, restrict unauthenticated access to the get_api_video API endpoint (e.g., via a WAF or reverse-proxy rule) and review server logs for anonymous requests to get_api_video referencing video slugs, which would indicate probing. Audit which videos are restricted to user groups and assume owner account details may have been exposed if such requests are found.