CVE-2026-92577: AVideo through 29.0 API get_api_video Broken Access Control via clean_title
In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo deployments through version 29.0 are affected if they use the get_api_video endpoint and have videos restricted to user groups. The affected clean_title branch can expose those restricted videos and associated owner information to unauthenticated callers.
What does an attacker need to exploit it?
No authentication, privileges, or user interaction are required. An attacker needs the public slug of a target video and can query the get_api_video API endpoint through the clean_title branch.
What information could be disclosed?
The issue can disclose user-group-restricted video data and sensitive owner fields. Reported fields include email address, phone number, address, birth date, and administrator status.
How can defenders assess whether they are affected?
Verify whether the deployment runs AVideo version 29.0 or earlier and exposes the get_api_video endpoint. Test whether an anonymous request using a restricted video's public slug returns that video's data or owner fields.