PT-2026-28621 · Avideo · Avideo

Offset · Published 2026-03-27 · Updated 2026-03-30 · CVE-2026-34364

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The categories.json.php endpoint, which serves the category listing API, does not properly enforce user group-based access controls on categories. Without the ?user= parameter, user group filtering is bypassed, exposing all non-private categories. When the ?user= parameter is used, a type confusion issue causes the filter to use the admin user's (user id=1) group memberships instead of the current user's, also bypassing the filter. The API endpoint is categories.json.php.

Recommendations Versions prior to 26.0 should be updated to version 26.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-34364

GHSA-73GR-R64Q-7JH4

Affected Products

Avideo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34364.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-73gr-r64q-7jh4 · Exploit
• https://github.com/WWBN/AVideo/commit/6e8a673eed07be5628d0b60fbfabd171f3ce74c9 · Patch
• https://osv.dev/vulnerability/GHSA-73gr-r64q-7jh4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34364 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2037719445213491704 · Twitter Post
• https://twitter.com/cyberbivash/status/2037610133446955399 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037720428127400236 · Twitter Post