CVE-2026-85156CWE-200information-disclosure

CVE-2026-85156

Medium · published September 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-03T17:06Z
References (2)
https://github.com/WWBN/AVideo/security/advisories/GHSA-h779-9wfc-c6m8 · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-broken-access-control-via-channel-page · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    WWBN AVideo Broken Access Control via Channel Page
    cvelistv5