WWBN AVideo: Missing Authorization in objects/import.json.php (CVE-2026-126809)
WWBN AVideo versions through 29.7.1 contain a missing authorization vulnerability in objects/import.json.php that allows unauthorized access to and manipulation of media and metadata.
CVE search metadata
CVE search record: CVE-2026-126809. Severity: high. CVSS: 7.1. KEV: no. Product: AVideo (<= 29.7.1). Brief: WWBN AVideo: Missing Authorization in objects/import.json.php (CVE-2026-126809). Brief link: https://feed.craftedsignal.io/briefs/2026-11-avideo-auth-bypass-cve-2026-126809/
Triage facts
Revision 1- Applicability
- AVideo (<= 29.7.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php. This flaw allows users to import other users' MP4 files by referencing folders under videos/.
Impact
Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.
Recommendation
Monitor the vendor for updates addressing this vulnerability.