CVE-2026-90541: WWBN AVideo Unauthenticated Information Disclosure via menus.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can send a GET request to the affected endpoint can retrieve the menu data. No privileges or user interaction are required.
What information is exposed?
The endpoint returns all menu data, including names of inactive menus and menus intended only for administrators that are not shown in the public navigation bar.
How can I determine whether an installation is affected?
Check whether plugin/TopMenu/menus.json.php is reachable without authentication and whether an unauthenticated GET request returns menu data. The issue is reported in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.