CVE-2026-88875 describes an information exposure vulnerability in WWBN AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1. The API method get_api_video() returns video data joined with the video owner's user record. The function removeSensitiveUserFields() is only called when the caller is unauthenticated or lacks a valid API secret, but it does not verify if the authenticated user is the owner of the video. Consequently, any authenticated user with low privileges can retrieve another user's email, username, and permission flags (isAdmin, canUpload, canStream) that should be restricted. This flaw leads to unauthorized disclosure of private personal information. No official fix or patch was available at the time of publication.

The vulnerability allows unauthorized disclosure of private personal information including email addresses, usernames, and user permission flags to any authenticated user. This exposure can lead to privacy violations and potential misuse of user data. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and low impact on confidentiality. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API access to trusted users and monitor for unauthorized data access. Avoid using low-privilege accounts for sensitive API calls. Follow vendor updates for an official fix.