CVE-2026-126809: WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php

Published Nov 11, 2026

Updated

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.

Event History

Nov 11, 2026

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with uploader privileges can exploit it. The attack is network-accessible and does not require user interaction, but requires the attacker to reference a folder under videos/.

What content and actions are exposed?

An attacker can import other users' MP4 files, including private, unlisted, password-protected, and pay-per-view videos. They can also read associated .txt or .html sidecar files as descriptions, list files through objects/listFiles.json.php, and delete victims' media using the delete parameter.

Which versions are known to be affected?

WWBN AVideo through version 29.7.1 is affected.

CVE-2026-126809: WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php

Event History

Frequently Asked Questions

Who can exploit this issue?

What content and actions are exposed?

Which versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content and actions are exposed?

Which versions are known to be affected?