CVE-2026-92585: Missing Authorization in WWBN AVideo
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.
AI Analysis
Technical Summary
CVE-2026-92585 describes a missing authorization vulnerability in WWBN AVideo through version 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1). The API like endpoint does not validate video access permissions, enabling logged-in users to submit like and dislike votes on password-protected and group-restricted videos. This is achieved by calling the set.json.php endpoint with APIName parameters, bypassing intended access controls.
Potential Impact
The vulnerability allows unauthorized manipulation of video vote counters by authenticated users who do not have permission to view the videos. This could distort popularity metrics or user feedback on videos but does not directly allow viewing restricted content or other higher-impact actions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the API endpoints or implementing additional authorization checks at the application level to prevent unauthorized voting.
CVE-2026-92585: Missing Authorization in WWBN AVideo
Description
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.
CVSS v4.0
Score 5.3medium
Affected software
WWBN
AVideo
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92585 describes a missing authorization vulnerability in WWBN AVideo through version 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1). The API like endpoint does not validate video access permissions, enabling logged-in users to submit like and dislike votes on password-protected and group-restricted videos. This is achieved by calling the set.json.php endpoint with APIName parameters, bypassing intended access controls.
Potential Impact
The vulnerability allows unauthorized manipulation of video vote counters by authenticated users who do not have permission to view the videos. This could distort popularity metrics or user feedback on videos but does not directly allow viewing restricted content or other higher-impact actions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the API endpoints or implementing additional authorization checks at the application level to prevent unauthorized voting.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T13:47:20.118Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aab120655bf5e2cf536882b
Added to database: 09/16/2026, 22:02:46 UTC
Last enriched: 09/16/2026, 23:13:15 UTC
Last updated: 09/17/2026, 02:02:30 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.