CVE-2026-34364

CVE-2026-34364 (WWBN AVideo) affects the category listing API implemented in the categories.json.php endpoint. In versions up to and including 26.0, category access control is not enforced when no ?user= parameter is provided, causing all non-private categories (including those restricted to spec...