CVE-2026-88875 Details
Description
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.
A vulnerability exists in AVideo versions through revision c3edcc274c389816d434acadac07ee78eaf330c1, specifically in the 'APIName=video' response. The issue arises because the API fails to properly sanitize sensitive user information, such as email addresses and account permissions, from video owners' user records. This flaw allows low-privilege authenticated users to access another user's video and retrieve private information that should only be available to the video owner or to users with a valid API secret. The vulnerability stems from the API's incorrect handling of user authentication and ownership verification, leaving personal information exposed to unauthorized users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-qwp4-vh4w-2fh9 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/avideo-incomplete-api-sanitization-information-disclosure | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= c3edcc274c389816d434acadac07ee78eaf330c1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |