CVE-2026-88875

Name of the Vulnerable Software and Affected Versions AVideo versions prior to c3edcc274c389816d434acadac07ee78eaf330c1

Description Incomplete sanitization of sensitive user fields occurs in the APIName=video response. The API::get api video() function calls removeSensitiveUserFields() only when the caller is unauthenticated and lacks a valid API secret, failing to compare User::getId() with the row's users id. Consequently, an authenticated account with low privileges can request another user's video to obtain the owner's email address, account name (user), and the isAdmin, canUpload, and canStream flags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.