CVE-2026-126545: WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored videopassword values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a registered AVideo user account. They can subscribe to a tag and query the tags API to retrieve data for videos that should be unlisted, group-restricted, or password-protected.
What information can be exposed through the affected API?
The tags API can disclose video filenames, titles, and stored video_password values. The exposed password values can enable unauthorized viewing of protected videos.
How can I determine whether my deployment is affected?
Deployments running WWBN AVideo through 29.7.1 are affected if the API plugin's get_api_tags() endpoint is available to registered users. Affected behavior can be checked by using a registered test account subscribed to a tag and querying APIName=tags for restricted videos associated with that tag.