Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access… (CVE-2026-108476)

CVE-2026-108476 describes a missing authorization vulnerability in the VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) affecting versions up to 7.5.13. The issue arises from incorrectly configured access control security levels, which may allow an attacker with limited privileges to access functionality or data that should be restricted. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.0, vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, indicating network attack vector, low attack complexity, requires low privileges, no user interaction, scope changed, and limited confidentiality impact. There is no vendor advisory or patch information provided, and no known exploits have been reported.

The vulnerability could allow an attacker with some privileges to bypass access control restrictions, potentially leading to unauthorized access to sensitive information or functionality within the affected application. The confidentiality impact is limited, and there is no impact on integrity or availability reported. No active exploitation is known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations to ensure proper authorization enforcement. Monitor for any updates from the vendor regarding patches or mitigations.