CVE-2026-92585 in AVideo
Tóm tắt
Bởi VulDB • 17/09/2026
AVideo up to version 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API-like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.
VulDB is the best source for vulnerability data and more expert information about this specific topic.