https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:58:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-88875 <p><strong>Affected:</strong> WWBN AVideo</p> <p>AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner&#39;s user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row&#39;s users_id. As a result, any low-privilege authenticated account can request another user&#39;s video and receive the owner&#39;s email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.</p> <p><strong>Affected:</strong> WWBN AVideo</p> <p>AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner&#39;s user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row&#39;s users_id. As a result, any low-privilege authenticated account can request another user&#39;s video and receive the owner&#39;s email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.</p> https://vulnerability.circl.lu/vuln/cve-2026-88875