CVE-2026-90539 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter. Attackers can retrieve hidden menu item URLs including embedded admin-tool secret query parameters not exposed in the public navbar.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified within WWBN AVideo, specifically linked to commit c3edcc274c389816d434acadac07ee78eaf330c1, represents a critical failure in access control mechanisms for the plugin/TopMenu/menuItems.json.php endpoint. This flaw is classified as a missing authentication vulnerability, which falls under the broader category of broken access control. In secure software architecture, endpoints that return configuration data or menu structures should strictly enforce authentication checks to ensure that only authorized users can retrieve sensitive structural information about the application interface. The absence of such verification allows unauthenticated actors to interact with this endpoint directly via HTTP requests, bypassing any intended security boundaries designed to protect administrative configurations from public view.
The technical mechanism of exploitation involves submitting a POST request containing a menuId parameter to the vulnerable endpoint. By manipulating this input, an attacker can query specific menu structures that are not visible in the standard public-facing navigation bar. The system fails to verify whether the requesting user possesses the necessary privileges to access inactive or hidden administrative menus. Consequently, the application returns detailed JSON data describing these internal components. This behavior indicates a fundamental oversight in the server-side logic where input validation and authorization checks were either omitted or incorrectly implemented for this specific API route, allowing arbitrary retrieval of menu item definitions regardless of the user's session state or role permissions.
The operational impact of this vulnerability is significant due to the nature of the data exposed. The retrieved inactive admin menu items often contain embedded secret query parameters that are intended solely for administrative tooling and internal system operations. These hidden URLs may point to sensitive management interfaces, diagnostic tools, or configuration panels that rely on these specific parameters for authentication or session validation. By obtaining these URLs and their associated secrets, an attacker gains a detailed map of the application's backend architecture. This information can be leveraged in subsequent attacks to target other vulnerabilities within those admin tools, facilitate credential stuffing if weak authentication is present on those hidden endpoints, or simply gain reconnaissance intelligence that aids in more sophisticated intrusion attempts against the platform.
From a threat modeling perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site may lead to CSRF Mitigation Issues if the exposed URLs are used for further exploitation. In terms of MITRE ATT&CK framework tactics, this activity corresponds to Discovery techniques where adversaries gather information about the target environment to plan future actions. Specifically, it relates to Application Data Discovery and potentially Account Manipulation if the hidden admin tools allow privilege escalation or configuration changes once accessed via the exposed secrets. The exposure of internal API structures reduces the attack surface's obscurity, making it easier for automated scanners and human attackers to identify additional points of entry within the application ecosystem.
To mitigate this vulnerability, immediate remediation should focus on enforcing strict authentication checks at the endpoint level. Developers must ensure that any request to menuItems.json.php requires a valid session token or API key associated with an authenticated user account. Furthermore, authorization logic must be implemented to verify that the authenticated user has explicit permission to view inactive admin menus; this check should occur before generating and returning the JSON response. Input validation on the menuId parameter is also recommended to prevent potential injection attacks alongside access control issues. For organizations currently running affected versions of WWBN AVideo, upgrading to a patched version where these security controls are properly implemented is essential. Until an update is applied, network-level protections such as Web Application Firewalls can be configured to block unauthorized POST requests to this specific endpoint based on known request patterns or missing authentication headers.