CVE-2026-92585: AVideo through 29.0 Missing Authorization Check via API Like Endpoint
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any logged-in AVideo user can exploit it. The attacker does not need permission to view the targeted password-protected or group-restricted video.
What access or interaction does exploitation require?
Exploitation requires an authenticated account and the ability to send like or dislike requests to the set.json.php endpoint using APIName parameters. No victim interaction is required.
What is the practical impact?
An attacker can increment like or dislike vote counters for videos they are not authorized to watch. The provided information indicates an integrity impact on vote data, not disclosure of protected video content.
How can administrators determine whether they are affected?
Deployments running AVideo through version 29.0, including commit c3edcc274c389816d434acadac07ee78eaf330c1, are affected according to the provided advisory information.