CVE-2026-92585

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in its API like endpoint. The root cause is a missing authorization check in the set.json.php endpoint when called with APIName parameters, allowing any logged-in user to submit like o...

CVE-2026-92585 AVideo through 29.0 Missing Authorization Check via API Like Endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...