CVE-2026-126545

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.7.2

Description Registered users can access restricted video data due to missing authorization in the get api tags() function within plugin/API/API.php. By subscribing to a tag and querying the 'tags' API endpoint, an attacker can retrieve filenames, titles, and video password values for videos that are unlisted, group-restricted, or password-protected, leading to unauthorized viewing.

Recommendations Update to version 29.7.2 or later. As a temporary workaround, restrict access to the get api tags() function until the update is applied.