WWBN AVideo up to 29.0 objects/users.json.php User::getAllUsers ignoreAdmin missing authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in WWBN AVideo up to 29.0. This impacts the function User::getAllUsers of the file objects/users.json.php. Such manipulation of the argument ignoreAdmin leads to missing authentication. This vulnerability is listed as CVE-2026-43881. The attack may be performed from remote. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 29.0. It has been rated as critical. Affected by this issue is the function User::getAllUsers of the file objects/users.json.php. The manipulation of the argument ignoreAdmin with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality. CVE summarizes:

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter causes the handler to set $ignoreAdmin = true for any non-admin caller (including unauthenticated visitors), which defeats the admin-only guard inside User::getAllUsers()/User::getTotalUsers(). A second path accepts users_id and calls User::getUserFromID() directly with no permission check, producing a single-user oracle. Both paths return id, identification (display name), channel URL, photo, background, and status, plus the total account count. Commit d9cdc702481a626b15f814f6093f1e2a9c20d375 contains an updated fix.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-43881 since 05/04/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

By approaching the search of inurl:objects/users.json.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch d9cdc702481a626b15f814f6093f1e2a9c20d375 is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion