GHSA-3w98-8958-84rh: WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

Published Nov 11, 2026

Updated

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored videopassword values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.

Event History

Nov 11, 2026

CVE Published

via OSV·12:58 AM

Data Sourced

via OSV·12:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a registered AVideo user account. They must be able to subscribe to a tag and query the tags API; no user interaction is required.

What content could be exposed?

The tags API can disclose filenames, titles, and stored video_password values for unlisted, group-restricted, and password-protected videos. The disclosed information can enable unauthorized viewing.

How can I determine whether my deployment is affected?

Deployments running WWBN AVideo through version 29.7.1 are affected. Review whether registered users can subscribe to tags and query the API with APIName=tags, particularly where restricted video content exists.

GHSA-3w98-8958-84rh: WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

Event History

Frequently Asked Questions

Who can exploit this issue?

What content could be exposed?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content could be exposed?

How can I determine whether my deployment is affected?