CVE-2026-43881 Details

A vulnerability in WWBN AVideo versions through 29.0 allows unauthenticated users to enumerate registered user accounts. The issue arises in the 'objects/users.json.php' file, where the 'isCompany' parameter bypasses admin-only restrictions, enabling the disclosure of all user data. Additionally, the 'users_id' parameter can be used to retrieve information about specific users without any permission checks. This vulnerability exposes sensitive details such as user IDs, display names, channel URLs, profile photos, background images, and account statuses.

To address this vulnerability, require authentication for accessing 'objects/users.json.php' and restrict the user enumeration paths to users who need to search. Remove the 'isCompany' parameter's ability to bypass admin checks, and consider setting a limit on the 'rowCount' parameter to prevent bulk harvesting of user data.