CVE-2026-90541 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo stems from a critical authentication bypass within the application's plugin architecture, specifically affecting the menus.json.php endpoint located under the plugin/TopMenu directory. This flaw was introduced or exposed through commit c3edcc274c389816d434acadac07ee78eaf330c1 and represents a significant lapse in access control mechanisms. The core technical issue is that this specific endpoint fails to enforce any form of authentication before processing incoming requests. In secure web application design, endpoints that serve administrative or configuration data must strictly validate the identity and privileges of the requesting user. By omitting these checks, the system inadvertently exposes sensitive internal structures to anyone with network access to the service.
From a technical perspective, this vulnerability allows unauthenticated attackers to send simple GET requests to the affected endpoint without providing valid credentials or session tokens. The server processes these requests as if they were coming from an authorized administrator, returning comprehensive JSON data that details all menu configurations. This includes not only public-facing menus but also inactive ones and those designated for administrative use only. These admin-only menus are typically hidden from the standard user interface to prevent casual users from seeing sensitive navigation options or management tools. The exposure of this data reveals the internal topology of the application's administration panel, providing attackers with a map of available features and potential attack surfaces that were previously obscured by design.
The operational impact of this information disclosure is substantial, as it facilitates further reconnaissance and potentially more severe attacks. By retrieving inactive and admin-only menu names, an attacker gains insight into the specific modules and functionalities enabled or configured within the AVideo instance. This knowledge can be used to identify other vulnerable endpoints that might correspond to these hidden menus. For example, if a menu item references a specific video management tool or user administration feature, the attacker now knows exactly which URLs or API calls to target next. This significantly lowers the barrier for subsequent exploitation attempts, such as privilege escalation, unauthorized content modification, or complete system compromise, turning an information leak into a stepping stone for deeper intrusion.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically where access control is not properly enforced on sensitive data endpoints. It also maps to the ATT&CK technique T1087, Account Discovery, as it allows an attacker to enumerate system accounts and administrative structures without authentication. Furthermore, since the information revealed includes menu configurations that may hint at other active plugins or features, it relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. The lack of authentication on this endpoint violates fundamental security principles regarding the separation of duties and the principle of least privilege, as public users are granted access to resources reserved for privileged roles.
To mitigate this vulnerability, immediate action is required to enforce strict authentication checks on the menus.json.php endpoint. Developers should implement middleware or route-level filters that verify valid user sessions and confirm administrative privileges before any data is returned. Additionally, input validation should be applied to ensure that only expected parameters are processed, although in this case, the primary failure is the lack of identity verification. It is also recommended to review all other endpoints within the plugin/TopMenu directory for similar authentication gaps. Regular security audits and code reviews focusing on access control logic can help prevent such oversights in future updates. Until a patch is applied, network-level controls such as firewall rules or reverse proxy configurations should restrict direct external access to this specific endpoint if possible, limiting exposure while the software vendor releases an official fix.