UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126809

WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php

Severity
Medium 6.1
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data · Change some data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
Sources
CVE Program

Description

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.

From the CVE Program.

Affected software

SoftwareAffected versions
AVideoServers and applications · cna:wwbn|avideo
  • Every version up to 29.7.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126809