CVE-2026-34364 Details

A vulnerability exists in WWBN AVideo versions through 26.0, specifically in the categories.json.php endpoint, which handles the category listing API. The issue arises from a failure to properly enforce user group-based access controls, allowing unauthorized access to category information. By default, the endpoint skips user group filtering entirely, exposing all non-private categories, including those restricted to specific user groups. When the ?user= parameter is used, a type confusion bug causes the filter to incorrectly apply the admin user's group memberships instead of the current user's, further undermining access control. This vulnerability allows any unauthenticated user to bypass intended restrictions and access sensitive category information.

Users should update to the latest version of WWBN AVideo, where this vulnerability has been fixed. Instructions for updating can be found in the AVideo documentation.