WWBN AVideo versions <= 29.0 contain a missing authentication vulnerability (CWE-306) in the objects/users.json.php endpoint. Two unauthenticated paths allow disclosure of registered user accounts: one path uses the isCompany parameter to bypass admin-only guards by setting $ignoreAdmin=true for non-admin and unauthenticated callers, defeating User::getAllUsers()/User::getTotalUsers() protections; the other path accepts a users_id parameter and calls User::getUserFromID() without permission checks, enabling retrieval of individual user details. Both paths return sensitive user metadata including id, display name, channel URL, photo, background, status, and total user count. A commit (d9cdc702481a626b15f814f6093f1e2a9c20d375) reportedly contains a fix, but no official patch or vendor advisory is provided.

The vulnerability allows unauthenticated attackers to enumerate all registered user accounts and retrieve detailed user information, potentially aiding further reconnaissance or targeted attacks. The disclosed data includes user IDs, display names, channel URLs, photos, backgrounds, statuses, and total user counts. There is no indication of direct impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A commit addressing the issue has been identified, but no official patch or vendor advisory is available at this time. Until an official fix is released, restrict access to the affected endpoint if possible or implement additional access controls to prevent unauthenticated access.