CVE-2026-85157

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description Broken access control exists in the unauthenticated 'feed/index.php' endpoint. When the program id parameter is supplied, per-video visibility checks are disabled. This allows attackers to enumerate playlist identifiers and retrieve unlisted or group-restricted videos by requesting the RSS feed with any visible playlist ID, including empty playlists that may return the entire hidden video catalogue of the site.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.