CVE-2026-92585 in AVideo
Summary
by MITRE • 09/17/2026
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in AVideo versions up to 29.0, specifically associated with commit c3edcc274c389816d434acadac07ee78eaf330c1, represents a critical failure in access control logic within the platform's API infrastructure. This flaw allows authenticated users to manipulate voting metrics on content that they are explicitly denied permission to view or interact with under normal circumstances. The core technical issue lies in the insufficient validation of video access permissions when processing requests through the set.json.php endpoint. While the web interface correctly enforces restrictions for password-protected videos and those restricted to specific groups, the underlying API logic fails to perform equivalent checks before updating vote counts. This discrepancy creates a significant security gap where the authentication state is verified, but authorization regarding resource accessibility is neglected during the voting transaction process.
From an operational perspective, this vulnerability enables attackers who possess valid user credentials to increment like and dislike counters on restricted videos without ever needing to decrypt passwords or gain membership in protected groups. By crafting specific API calls with appropriate APIName parameters, malicious actors can artificially inflate engagement metrics for content they cannot access. This capability undermines the integrity of the platform's social proof mechanisms and data accuracy. For video creators, this results in skewed analytics that do not reflect genuine audience interaction, potentially affecting their ability to gauge true viewer sentiment or optimize content strategy based on reliable statistics. Furthermore, it allows bad actors to manipulate public perception by artificially boosting visibility for restricted material, which could be used for promotional spamming or harassment campaigns against channel owners whose content is intentionally kept private or limited in scope.
The technical classification of this flaw aligns with CWE-284, Improper Access Control, as the application fails to enforce proper authorization policies when processing user input. Additionally, it maps to MITRE ATT&CK technique T1078, Valid Accounts, because the exploitation relies on legitimate credentials rather than anonymous access or credential theft. The attack vector is classified as remote and requires low complexity since any authenticated user can execute the exploit without specialized tools beyond a standard HTTP client capable of sending JSON payloads. This highlights a common architectural weakness in web applications where API endpoints are developed independently from frontend logic, leading to inconsistent security enforcement across different interaction layers.
To mitigate this vulnerability, developers must implement strict server-side validation for all access-controlled resources before processing any state-changing requests such as voting or commenting. The set.json.php endpoint should query the database to verify that the requesting user has explicit permission to view the target video ID before allowing the vote counter to be updated. This check must apply uniformly regardless of whether the request originates from a web browser interface or an API call. Additionally, implementing rate limiting on the voting endpoints can help mitigate abuse even if access control is temporarily bypassed. Organizations running affected versions should upgrade immediately to a patched release where this authorization logic has been corrected and conduct a thorough audit of other API endpoints to ensure no similar permission checks are missing in related functionalities such as sharing or favoriting restricted content.