PT-2026-27187 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33685

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.1

Description AVideo is an open source video platform. Versions up to and including 26.0 lack authentication and authorization checks on the plugin/AD Server/reports.json.php endpoint. This allows unauthenticated attackers to extract ad campaign analytics data, including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (reports.php) and CSV export (getCSV.php) correctly enforce User::isAdmin(), but the JSON API was left unprotected.

Recommendations Update AVideo to version 26.1 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-33685

GHSA-J36M-74G2-7M95

Produtos afetados

Avideo

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33685.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-j36m-74g2-7m95 · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/daca4ffb1ce19643eecaa044362c41ac2ce45dde · Correção
• https://osv.dev/vulnerability/GHSA-j36m-74g2-7m95 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33685 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33685 · Aviso do Fabricante