CVE-2026-33501 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains an information disclosure vulnerability caused by missing authentication and authorization checks in plugin/Permissions/View/Users_groups_permissions/list.json.php, letting unauthenticated users retrieve the complete permission matrix, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can access sensitive permission mappings, potentially aiding further attacks or privilege escalation.

Mitigation

Update to a version including commits dc3c825734628bb32550d0daa125f05bacb6829c and b583acdc9a9d1eab461543caa363e1a104fb4516 or the latest available version.

References

• https://github.com/WWBN/AVideo/commit/dc3c825734628bb32550d0daa125f05bacb6829c
• https://github.com/WWBN/AVideo/security/advisories/GHSA-96qp-8cmq-jvq8
• https://github.com/WWBN/AVideo/commit/b583acdc9a9d1eab461543caa363e1a104fb4516

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner