Threats tagged 'ghsa-q24m-x4jf-vhrw'

CVE-2026-92577 is a high-severity authorization bypass vulnerability in WWBN AVideo versions up to 29.0. The flaw exists in the API get_api_video endpoint's clean_title branch, allowing anonymous users to bypass user-group restrictions by querying videos via their public slug. This results in unauthorized disclosure of sensitive user personally identifiable information (PII), including email, phone number, address, birth date, and administrator status.