CVE-2026-90548 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo stems from a critical failure in authorization logic within the ImageGallery component, specifically affecting the list.json.php endpoint. This flaw represents an Access Control issue where the application fails to properly validate whether the requesting user has sufficient privileges to access specific resources. In secure software architecture, endpoints that return metadata about protected assets must enforce strict authentication and authorization checks before disclosing any information. However, in this instance, the server processes requests for gallery file listings without verifying if the requester is an authenticated administrator or a legitimate owner of the content. This oversight allows unauthenticated actors to interact with internal application logic as if they were authorized users, bypassing the intended security boundaries designed to protect private media assets.
From a technical perspective, this vulnerability enables attackers to enumerate filenames and retrieve direct URLs for files stored within password-protected image galleries. By directly accessing the list.json.php endpoint via HTTP requests, an attacker can obtain structured data containing paths or links to sensitive images that are otherwise hidden from public view due to their protected status. Once these URLs are extracted, the subsequent step involves fetching the actual file content. Since the protection mechanism relies on application-level access control rather than infrastructure-level restrictions such as web server configuration rules for private directories, the retrieved URLs often point directly to accessible storage locations or generate temporary signed links that can be exploited if not properly scoped with short expiration times and strict referer checks. This two-stage attack vector effectively neutralizes the password protection feature of the galleries by exposing their contents through metadata leakage rather than brute-forcing credentials.
The operational impact of this vulnerability is significant, particularly for organizations or individuals using AVideo to host sensitive visual content. The ability to list and download files from protected galleries constitutes a severe breach of confidentiality. For businesses, this could lead to the exposure of proprietary images, client data, or confidential marketing materials. For individual users, it may result in privacy violations involving personal photographs or private media. Furthermore, because the vulnerability allows for automated enumeration, attackers can script attacks to scrape large volumes of protected content rapidly, leading to widespread data leakage across multiple galleries with minimal effort. This undermines user trust and exposes the platform owners to potential legal liabilities regarding data protection regulations such as GDPR or CCPA if personal identifiable information is contained within the exposed images.
This vulnerability aligns closely with CWE-284 Improper Access Control, which covers scenarios where access control rules are not enforced correctly against an actor interacting directly with a security-relevant component. Additionally, it maps to MITRE ATT&CK technique T1078 Valid Accounts and specifically relates to the enumeration phase of reconnaissance or data exfiltration via application layer protocols. The lack of proper validation on server-side endpoints is a common pitfall in web development that highlights the necessity of implementing defense-in-depth strategies. To mitigate this risk, developers must ensure that all API endpoints returning sensitive metadata enforce strict authentication checks and verify user permissions against the specific resource being requested. Implementing robust access control lists at both the application layer and potentially reinforcing it with server-level configurations can prevent unauthorized enumeration. Regular security audits focusing on authorization logic in dynamic content delivery systems are essential to identify and remediate such flaws before they can be exploited by malicious actors seeking to bypass authentication mechanisms through metadata exposure.