CVE-2026-92586: AVideo through 29.0 Missing Authorization via comment API endpoint
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated AVideo user can exploit it. The attacker only needs to send a POST request to the comment API endpoint and supply the ID of a password-protected or group-restricted video.
What is the impact on restricted videos?
An attacker can write comments on videos they are not authorized to watch. The provided information indicates an integrity impact only; it does not state that the attacker can view the protected video or its contents.
How can I determine whether an instance is affected?
AVideo versions through 29.0 are affected, including commit c3edcc274c389816d434acadac07ee78eaf330c1. You can also test with a low-privilege authenticated account by attempting to post a comment through the API to a video restricted from that account.