PT-2026-28621 · Avideo · Avideo

Offset · Publicado 2026-03-27 · Atualizado 2026-03-30 · CVE-2026-34364

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The categories.json.php endpoint, which serves the category listing API, does not properly enforce user group-based access controls on categories. Without the ?user= parameter, user group filtering is bypassed, exposing all non-private categories. When the ?user= parameter is used, a type confusion issue causes the filter to use the admin user's (user id=1) group memberships instead of the current user's, also bypassing the filter. The API endpoint is categories.json.php.

Recommendations Versions prior to 26.0 should be updated to version 26.0 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-34364

GHSA-73GR-R64Q-7JH4

Produtos afetados

Avideo

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34364.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-73gr-r64q-7jh4 · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/6e8a673eed07be5628d0b60fbfabd171f3ce74c9 · Correção
• https://osv.dev/vulnerability/GHSA-73gr-r64q-7jh4 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037719445213491704 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-34364 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34364 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2037610133446955399 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2037720428127400236 · Publicação no Twitter