CVE-2026-92585 | BDVDB-2026-375438 Detail

Description#

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-16Record published in the CVE List.
2. Version 22026-09-19Most recent update recorded in the CVE List.