CVE-2026-92586 in AVideo
Tóm tắt
Bởi VulDB • 17/09/2026
AVideo up to version 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.