CVE-2026-43881

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter causes the handler to set $ignoreAdmin = true for any non-admin caller (including unauthenticated visitors), which defeats the admin-only guard inside User::getAllUsers()/User::getTotalUsers(). A second path accepts users_id and calls User::getUserFromID() directly with no permission check, producing a single-user oracle. Both paths return id, identification (display name), channel URL, photo, background, and status, plus the total account count. Commit d9cdc702481a626b15f814f6093f1e2a9c20d375 contains an updated fix.

• CWE-306

• https://github.com/WWBN/AVideo/commit/d9cdc702481a626b15f814f6093f1e2a9c20d375
• https://github.com/WWBN/AVideo/security/advisories/GHSA-6rvw-7p8v-mjfq
• https://github.com/WWBN/AVideo/security/advisories/GHSA-6rvw-7p8v-mjfq

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43876WWBN AVideo is an open source video platform. In versions up…6.4
• CVE-2026-43877WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-43878WWBN AVideo is an open source video platform. In versions up…6.1
• CVE-2026-43879WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-4388The Form Maker by 10Web plugin for WordPress is vulnerable t…7.2
• CVE-2026-43880WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-43882WWBN AVideo is an open source video platform. In versions up…4.3
• CVE-2026-43883WWBN AVideo is an open source video platform. In versions up…4.2
• CVE-2026-43884WWBN AVideo is an open source video platform. In versions up…7.7
• CVE-2026-43885WWBN AVideo is an open source video platform. In versions up…7.7
• CVE-2026-43886Outline is a service that allows for collaborative documenta…8.2
• CVE-2026-43887Outline is a service that allows for collaborative documenta…7.3