CVE-2026-92577: AVideo through 29.0 API get_api_video Broken Access Control via clean_title

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-22
Weakness: CWE-639

Description

In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.

Affected products

WWBN AVideo: through 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-w59h-5r8w-686r
https://www.vulncheck.com/advisories/avideo-through-29.0-api-get-api-video-broken-access-control-via-clean-title

Get alerted when CVE-2026-92577 or the next vulnerability affects your stack