CVE-2026-92585CWE-862broken-access-control

CVE-2026-92585

Medium · published September 17, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-17T02:18Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-rrcx-6vw7-xwj8 · [email protected]https://www.vulncheck.com/advisories/avideo-through-29.0-missing-authorization-check-via-api-like-endpoint · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-rrcx-6vw7-xwj8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 21:46Z
    AVideo through 29.0 Missing Authorization Check via API Like Endpoint
    cvelistv5