CVE-2026-85157 in AVideo
Summary
by MITRE • 09/03/2026
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting the RSS feed with any visible playlist id, including empty playlists that return the entire site's hidden video catalogue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in WWBN AVideo represents a critical failure in access control mechanisms within the application's content delivery infrastructure. Specifically, this flaw resides in the unauthenticated endpoint located at feed/index.php, which is designed to generate RSS feeds for video playlists. Under normal operational conditions, the system should enforce strict visibility checks on individual videos before including them in any generated feed output. However, when an attacker supplies a program_id parameter during their request, the application logic bypasses these per-video visibility validations entirely. This architectural oversight allows the backend processing to ignore whether a specific video is marked as private, unlisted, or restricted to specific user groups, effectively treating all associated media assets as publicly accessible regardless of their configured security settings.
The operational impact of this broken access control is severe, enabling unauthorized enumeration and retrieval of sensitive content. By manipulating the program_id parameter, an attacker can systematically probe for valid playlist identifiers. Even if a targeted playlist contains no visible videos or is explicitly empty, the vulnerability causes the endpoint to return the entire hidden video catalogue from the site's database rather than returning an empty result set as expected by standard RSS feed behavior. This means that attackers do not need prior knowledge of specific private video IDs; they can leverage this flaw to scrape and enumerate all restricted content simply by iterating through potential playlist identifiers or exploiting the fallback behavior associated with invalid inputs. The ability to retrieve unlisted videos, which are typically intended for limited audiences such as internal teams or paying subscribers, compromises data confidentiality and intellectual property rights significantly.
From a classification perspective, this vulnerability aligns directly with CWE-284, which describes Improper Access Control, specifically the failure to enforce proper restrictions on unauthorized actions within a given context. The exploitation technique involves leveraging an unauthenticated interface to bypass security controls that should be enforced at the application logic layer rather than relying solely on network-level or session-based authentication for content visibility checks. In terms of offensive cybersecurity frameworks such as MITRE ATT&CK, this behavior facilitates Data from Information Repositories (T1213) and potentially contributes to Discovery activities by allowing an adversary to map out the structure and volume of hidden media assets without valid credentials. The lack of input validation on the program_id parameter further exacerbates the risk, indicating a broader pattern of insufficient sanitization that could lead to additional exploitation vectors beyond simple data exfiltration.
Mitigation strategies must focus on enforcing strict access control checks at the point where video visibility is determined for RSS feed generation. Developers should ensure that every video item included in an output stream undergoes independent verification against its configured privacy settings, regardless of whether it belongs to a playlist or is referenced via a program_id parameter. Implementing robust input validation to reject malformed or unexpected values for the program_id field will prevent the fallback behavior that exposes the entire catalogue. Additionally, applying principle of least privilege to database queries used by this endpoint ensures that even if logic errors occur, the underlying data retrieval operations are scoped strictly to publicly visible records only. Regular security audits and penetration testing focused on unauthenticated endpoints can help identify similar access control bypasses before they are exploited in production environments.