CVE-2026-92586: Missing Authorization in WWBN AVideo
AVideo versions up to and including 29.0 have a missing authorization check in the set_api_comment function. This flaw allows authenticated users to post comments on videos that are password-protected or restricted to certain groups, bypassing intended access controls. Attackers can exploit this by sending POST requests with arbitrary video IDs to the comment API endpoint to write unauthorized comments.
AI Analysis
Technical Summary
CVE-2026-92586 describes a missing authorization vulnerability in WWBN AVideo through version 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1). The set_api_comment function does not verify whether an authenticated user has permission to access a video before allowing them to post comments. Consequently, users can submit POST requests to the comment API with arbitrary video IDs, enabling them to comment on videos they are not authorized to watch, including password-protected and group-restricted content.
Potential Impact
The vulnerability allows authenticated users to bypass video access controls and post comments on restricted videos. This could lead to unauthorized content manipulation or information disclosure through comments, potentially undermining content privacy and user trust. However, the vulnerability does not allow viewing or accessing the video content itself, only posting comments.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions where possible and monitor comment activity for suspicious behavior related to unauthorized video IDs.
CVE-2026-92586: Missing Authorization in WWBN AVideo
Description
AVideo versions up to and including 29.0 have a missing authorization check in the set_api_comment function. This flaw allows authenticated users to post comments on videos that are password-protected or restricted to certain groups, bypassing intended access controls. Attackers can exploit this by sending POST requests with arbitrary video IDs to the comment API endpoint to write unauthorized comments.
CVSS v4.0
Score 5.3medium
Affected software
WWBN
AVideo
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92586 describes a missing authorization vulnerability in WWBN AVideo through version 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1). The set_api_comment function does not verify whether an authenticated user has permission to access a video before allowing them to post comments. Consequently, users can submit POST requests to the comment API with arbitrary video IDs, enabling them to comment on videos they are not authorized to watch, including password-protected and group-restricted content.
Potential Impact
The vulnerability allows authenticated users to bypass video access controls and post comments on restricted videos. This could lead to unauthorized content manipulation or information disclosure through comments, potentially undermining content privacy and user trust. However, the vulnerability does not allow viewing or accessing the video content itself, only posting comments.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions where possible and monitor comment activity for suspicious behavior related to unauthorized video IDs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T13:47:49.169Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aab120655bf5e2cf536882c
Added to database: 09/16/2026, 22:02:46 UTC
Last enriched: 09/16/2026, 23:13:18 UTC
Last updated: 09/17/2026, 00:49:53 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.