CVE-2026-90541

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1

Description An information disclosure issue exists where the system fails to require authentication for the 'plugin/TopMenu/menus.json.php' endpoint. Unauthenticated attackers can send GET requests to this endpoint to retrieve all menu data, including inactive and admin-only menu names that are not intended for display in the public navbar.

Recommendations Update WWBN AVideo to a version beyond commit c3edcc274c389816d434acadac07ee78eaf330c1. Restrict access to the 'plugin/TopMenu/menus.json.php' endpoint to minimize the risk of exploitation.