CVE-2026-90548: WWBN AVideo Missing Authorization in ImageGallery list.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the ImageGallery list.json.php endpoint can exploit it. No credentials or user interaction are required.
What information and content can be exposed?
The endpoint can disclose filenames and URLs for password-protected image galleries. An attacker can then retrieve the exposed gallery files without authentication.
How can I determine whether my deployment is affected?
AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. A deployment is vulnerable if an unauthenticated request to the ImageGallery list.json.php endpoint returns gallery file listings or URLs for password-protected galleries.