CVE-2026-88875: AVideo Incomplete API Sanitization Information Disclosure
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's usersid. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix API::get_api_video() so it compares User::getId() to the video row's users_id before deciding to keep sensitive user fields; ensure removeSensitiveUserFields() is applied to callers who are not the owner and do not present a valid API secret.
AVideo API (API::get_api_video() / removeSensitiveUserFields) Sensitive user field exposure logic = Return sensitive fields (e.g., email address, account name/user, isAdmin, canUpload, canStream) only when caller is the video owner (compare row users_id to User::getId()) or when caller has a valid API secret; for all other authenticated/low-privilege callers, removeSensitiveUserFields() should apply.
Event History
Frequently Asked Questions
Who is exposed to this disclosure?
Any deployment where low-privilege authenticated users can access the video API is exposed. Guests do not receive the sensitive owner fields, and callers using a valid API secret are explicitly permitted to receive them.
What does an attacker need to exploit it?
An attacker needs a low-privilege authenticated AVideo account and the ability to request a video owned by another user. No user interaction is required.
What information can be disclosed?
The response can expose the video owner's email address, account name, and the isAdmin, canUpload, and canStream account flags.
How can administrators determine whether they are affected?
Review whether the installation includes API::get_api_video() behavior where sensitive user fields are removed only for unauthenticated callers or callers without a valid API secret, without checking that the requester owns the video. Affected responses to an authenticated low-privilege account's request for another user's video will include the owner's sensitive fields.
Is a patch available?
No patched version was available at the time of the advisory. The affected code was identified through revision c3edcc274c389816d434acadac07ee78eaf330c1 on the master branch dated 2026-08-23.