CVE-2026-30885
published 2026-03-10CVE-2026-30885: WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without…
PriorityP433medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.36%
28.5th percentile
WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform. This vulnerability is fixed in 25.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | < 25.0 | 25.0 |
| wwbn | avideo | >= 0 < 25.0 | 25.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
osv·2026-03-07
CVE-2026-30885 [MEDIUM] AVideo has Unauthenticated IDOR - Playlist Information Disclosure
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
**Product:** AVideo (https://github.com/WWBN/AVideo)
**Version:** Latest (tested March 2026)
**Type:** Insecure Direct Object Reference (IDOR)
**Auth Required:** No
**User Interaction:** None
## Summary
The `/objects/playlistsFromUser.json.php` endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.
## Root Cause
The endpoint accepts a `users_id` parameter and directly queries the database without any authentication or authorization check.
**File:** `objects/playlistsFromUser.json.php`
```php
if (empty($_GET['us
GHSA
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
ghsa·2026-03-07
CVE-2026-30885 [MEDIUM] CWE-306 AVideo has Unauthenticated IDOR - Playlist Information Disclosure
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
**Product:** AVideo (https://github.com/WWBN/AVideo)
**Version:** Latest (tested March 2026)
**Type:** Insecure Direct Object Reference (IDOR)
**Auth Required:** No
**User Interaction:** None
## Summary
The `/objects/playlistsFromUser.json.php` endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.
## Root Cause
The endpoint accepts a `users_id` parameter and directly queries the database without any authentication or authorization check.
**File:** `objects/playlistsFromUser.json.php`
```php
if (empty($_GET['us
No detection rules found.
No public exploits indexed.
2026-03-10
Published