CVE-2026-92577

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description Broken access control exists in the clean title branch of the 'get api video' API endpoint. This flaw allows anonymous callers to bypass group restrictions by querying videos via their public slug, resulting in the unauthorized disclosure of Personally Identifiable Information (PII) of the video owner. Exposed sensitive fields include email, phone, address, birth date, and administrator status.

Recommendations Update to a version newer than 29.0. As a temporary mitigation, restrict access to the 'get api video' API endpoint.