CVE-2026-85156: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo

CVE-2026-85156 describes an exposure of sensitive information vulnerability in WWBN AVideo. The product fails to properly enforce access controls on the public channel page, allowing unauthenticated visitors to bypass restrictions on unlisted and group-restricted videos. This is caused by hardcoded visibility flags and an undefined property that the system does not validate correctly. As a result, attackers can access the channel endpoint and retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails intended only for members. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No patch or official remediation guidance is currently available, and there are no known exploits in the wild.

Unauthorized actors can access sensitive video content that is intended to be private or restricted, potentially leading to unintended disclosure of confidential or proprietary media. This exposure affects the confidentiality of video content on affected WWBN AVideo installations. There is no indication of privilege escalation or impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the public channel page or implementing additional access control mechanisms at the network or application level to prevent unauthorized viewing of unlisted or group-restricted videos.