CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.

• CWE-359

• https://github.com/WWBN/AVideo/security/advisories/GHSA-qwp4-vh4w-2fh9
• https://www.vulncheck.com/advisories/avideo-incomplete-api-sanitization-information-disclosure

Published

Sep 10, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8887The Listen Shortcode plugin for WordPress is vulnerable to S…6.4
• CVE-2026-88870WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.1
• CVE-2026-88871WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…4.3
• CVE-2026-88872AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…7.1
• CVE-2026-88873WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.1
• CVE-2026-88874AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…7.5
• CVE-2026-88876AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…7.5
• CVE-2026-88877Traefik is a HTTP reverse proxy and load balancer. In versio…9.8
• CVE-2026-88878Traefik is an HTTP reverse proxy and load balancer. In versi…5.3
• CVE-2026-88879Traefik is an HTTP reverse proxy and load balancer. In Traef…8.2
• CVE-2026-8888Version 3.0.7 of the Securly Chrome Extension downloads conf…7.5
• CVE-2026-88880Renovate before 44.11.3 fails to validate Link header destin…8.6