CVE-2026-33759: WWBN AVideo, заобикаляне на вход и права

Описание

Оригинално описание

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.

Засегнати продукти

• WWBN AVideo: <= 26.0

Вид слабост

• CWE-862 Missing Authorization
• CWE-639 Authorization Bypass Through User-Controlled Key

История

Други уязвимости в WWBN AVideo

• 6.9CVE-2026-116800
• 5.4CVE-2026-116139
• 5.3CVE-2026-114634
• 7.0CVE-2026-114633
• 5.1CVE-2026-114048

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-33759
• https://nvd.nist.gov/vuln/detail/CVE-2026-33759
• https://github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr
• https://github.com/WWBN/AVideo/commit/bb716fbece656c9fe39784f11e4e822b5867f1ca