ZeroDay Findings
Sign inSign up

Findings

CVE-2026-34364

WWBN AVideo is an open source video platform.

Published Mar 27, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the parameter is supplied, a type confusion bug causes the filter to use the admin user's (user_id=1) group memberships instead of the current user's, rendering the filter ineffective. Commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9 contains a fix.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 27, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the parameter is su

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the parameter is su

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-34364

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-34364

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no parameter), use

    nvd.nist.gov

References