CVE-2026-88875
Deferred Deferred - Pending Action

AVideo Information Disclosure via Incomplete Sanitization

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88875
EUVD
EUVD-2026-75425

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)
avideo avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88875 is an information disclosure vulnerability in AVideo where the API fails to properly sanitize sensitive user data in video responses. The system exposes email addresses, account names, admin status, and permission flags of video owners to any authenticated low-privilege user, even if they are not the owner or authorized to access this data.

Detection Guidance

To detect this vulnerability, monitor API requests to /api/video endpoints for authenticated users retrieving videos owned by other users. Check if responses include sensitive fields like email, account name, isAdmin, canUpload, or canStream for non-owners. Use logging to track requests where User::getId() does not match the video's users_id.

Impact Analysis

This vulnerability allows unauthorized users to access private user information such as email addresses, account names, and admin permissions by requesting videos owned by other users. It compromises user privacy and could enable further attacks like phishing or account takeover.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personally identifiable information (PII) without proper authorization. GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for protected health information. Unauthorized disclosure risks legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the API::get_api_video() function to only return sensitive data when the caller's User::getId() matches the video's users_id or when a valid API secret is provided. Temporarily disable the affected API endpoint if a patch is unavailable. Monitor logs for unauthorized data access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart