CVE-2026-92577 in AVideo
Summary
by MITRE • 09/17/2026
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in AVideo versions through 29.0 represents a critical failure in access control mechanisms within the application's API layer, specifically affecting the get_api_video endpoint. This flaw is rooted in how the system handles requests for video metadata when processed through the clean_title branch of its logic flow. The core issue lies in the insufficient verification of user permissions and session states before returning sensitive data to the requester. While the platform implements group-based restrictions intended to limit access to certain videos based on user roles or membership status, this security control is effectively bypassed due to a logical error that allows anonymous users to retrieve restricted content.
From a technical perspective, the vulnerability exploits the ability of an attacker to query video resources using their public slug identifier rather than requiring authenticated session tokens or valid group memberships for specific protected categories. The API endpoint fails to cross-reference the requested resource's access policies with the requester's authentication status before populating and returning the response object. Consequently, even though a video is designated as restricted to a specific user group, the system processes the request from an unauthenticated source without enforcing the necessary authorization checks. This misconfiguration results in the exposure of private fields associated with the video owner that are typically shielded by privacy settings or role-based access controls.
The operational impact of this vulnerability is severe due to the nature and sensitivity of the data exposed. Attackers can systematically enumerate videos using their public slugs, which are often predictable or easily discoverable through standard site navigation or sitemap analysis. For each video retrieved via this method, the API returns personally identifiable information belonging to the content owner. This includes sensitive attributes such as email addresses, phone numbers, physical addresses, birth dates, and administrative status indicators. The exposure of administrator status is particularly dangerous as it aids attackers in identifying high-value targets for subsequent social engineering attacks or privilege escalation attempts. The aggregation of this data facilitates identity theft, targeted phishing campaigns, and potential doxxing activities against users who reasonably expected their personal information to remain private within the context of a restricted video library.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized access to resources due to insufficient enforcement of security policies. Furthermore, from an offensive cybersecurity framework perspective, this behavior corresponds to ATT&CK technique T1078 Valid Accounts and potentially T1596 Search Open Technical Databases if the slugs are harvested broadly, although more accurately it reflects a failure in authorization checks akin to CWE-862 Missing Authorization. The exploitation does not require complex payload construction but relies on simple HTTP requests with specific parameters, making it easily automatable by threat actors seeking bulk data extraction or reconnaissance against user bases.
Mitigation strategies must focus on reinforcing the authentication and authorization logic within the get_api_video endpoint. Developers should ensure that all API endpoints performing sensitive operations verify both the existence of a valid session token and the associated permissions for every request, regardless of whether other parameters like public slugs are provided. The clean_title branch specifically needs to be audited to enforce group membership checks before any user PII is serialized into the response object. Additionally, implementing rate limiting on API endpoints can help mitigate bulk enumeration attacks while more permanent fixes are deployed. Input validation should also ensure that access control decisions are made based on verified identity claims rather than relying solely on resource identifiers provided by the client side. Regular security testing and code reviews focusing on authorization logic are essential to prevent similar bypasses in other parts of the application architecture.