PT-2026-29362 · Avideo · Avideo

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34732

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description The AVideo platform, an open source video platform, has an issue in the CreatePlugin template for list.json.php in versions 26.0 and prior. This template lacks authentication and authorization checks. While other templates, add.json.php and delete.json.php, require admin privileges, list.json.php does not. This omission affects plugins using the CreatePlugin code generator, resulting in 21 unauthenticated data listing endpoints. These endpoints expose sensitive data including user PII, payment transaction logs, IP addresses, user agents, and internal system records.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-34732

GHSA-G2MG-CGR6-VMV7

Affected Products

Avideo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34732.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-g2mg-cgr6-vmv7 · Exploit
• https://osv.dev/vulnerability/CVE-2026-34732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34732 · Security Note
• https://osv.dev/vulnerability/GHSA-g2mg-cgr6-vmv7 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/ea9f555850eb399126a103c1df2156b48734c990 · Note
• https://twitter.com/CVEnew/status/2039372120250036682 · Twitter Post