CVE-2026-90541
Received Received - Intake

Unauthenticated Access to Menu Data in AVideo

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90541
EUVD
EUVD-2026-76859

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90541 is an authentication bypass vulnerability in WWBN AVideo where the plugin/TopMenu/menus.json.php endpoint does not require authentication. This allows unauthenticated attackers to retrieve all menu data, including inactive and admin-only menus not visible in the public interface, by sending a simple GET request.

Detection Guidance

To detect this vulnerability, check if your AVideo instance has the plugin/TopMenu/menus.json.php endpoint accessible without authentication. Use a web browser or command-line tool like curl to send a GET request to http://your-server/plugin/TopMenu/menus.json.php. If it returns menu data without requiring login, the system is vulnerable.

Impact Analysis

This vulnerability exposes sensitive menu data, such as admin-only or inactive menu entries, to unauthorized users. Attackers could use this information to identify hidden features, plan further attacks, or gather intelligence about the application's structure and permissions.

Compliance Impact

This vulnerability exposes sensitive menu data including admin-only and inactive menu entries to unauthenticated users. Such unauthorized access to internal system information could violate data protection requirements under GDPR and HIPAA by failing to implement proper access controls and exposing sensitive configuration details.

Mitigation Strategies

Immediately restrict access to the plugin/TopMenu/menus.json.php endpoint by implementing authentication or blocking external requests. Update to the latest commit if a patch is available. If no patch exists, consider disabling the plugin or restricting access via firewall rules until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart