CVE-2026-81732: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo

CVE-2026-81732 describes an exposure of sensitive information vulnerability in WWBN AVideo through version 30.0. The application fails to require authentication on two endpoints—report4.json.php and report4.1.json.php—enabling unauthenticated access to daily and cumulative user registration counts. This information disclosure occurs without any session or authorization checks, potentially leaking user registration metrics to unauthorized actors.

The vulnerability allows unauthorized actors to retrieve user registration statistics, which may be considered sensitive information. However, it does not provide access to user credentials or other personal data. The CVSS 4.0 score is 6.9 (medium severity), reflecting the moderate impact of information disclosure without further privilege escalation or integrity/availability impact.

No official patch or remediation is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting access to these endpoints via network controls or web application firewall rules may help mitigate exposure.