CVE-2026-30885

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30885
WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform. This vulnerability is fixed in 25.0.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/WWBN/AVideo/commit/12adc66913724736937a61130ae2779c299445ca Patch
https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5 Exploit Mitigation Vendor Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5 Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
History

13 Mar 2026, 15:20

Type Values Removed Values Added
CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
First Time Wwbn
Wwbn avideo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-639
Summary
  • (es) WWBN AVideo es una plataforma de video de código abierto. Antes de 25.0, el endpoint /objects/playlistsFromUser.json.php devuelve todas las listas de reproducción para cualquier usuario sin requerir autenticación o autorización. Un atacante no autenticado puede enumerar IDs de usuario y recuperar información de la lista de reproducción, incluyendo nombres de listas de reproducción, IDs de video y el estado de la lista de reproducción para cualquier usuario en la plataforma. Esta vulnerabilidad está corregida en 25.0.
References () https://github.com/WWBN/AVideo/commit/12adc66913724736937a61130ae2779c299445ca - () https://github.com/WWBN/AVideo/commit/12adc66913724736937a61130ae2779c299445ca - Patch
References () https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5 - () https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5 - Exploit, Mitigation, Vendor Advisory

10 Mar 2026, 18:18

Type Values Removed Values Added
References () https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5 - () https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5 -

10 Mar 2026, 17:40

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 17:40

Updated : 2026-03-13 15:20

NVD link : CVE-2026-30885

Mitre link : CVE-2026-30885

CVE.ORG link : CVE-2026-30885

JSON object : View

Products Affected

wwbn

  • avideo
CWE
CWE-306

Missing Authentication for Critical Function

CWE-862

Missing Authorization

CWE-639

Authorization Bypass Through User-Controlled Key