CVE-2026-92586CWE-862broken-access-control

CVE-2026-92586

Medium · published September 17, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-17T02:18Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-fm4f-q895-8jhc · [email protected]https://www.vulncheck.com/advisories/avideo-through-29.0-missing-authorization-via-comment-api-endpoint · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-fm4f-q895-8jhc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 21:46Z
    AVideo through 29.0 Missing Authorization via comment API endpoint
    cvelistv5