CVE-2026-88875 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, security teams, and administrators of video sharing platforms should assess exposure and implement compensating controls. They should prioritize verifying exposure and implementing compensating controls, as the CVE record indicates a MEDIUM CVSS score of 5.3 and incomplete sanitization of sensitive user fields. Security teams should monitor API requests and responses for potential abuse or unauthorized access, as

Why it matters

The CVE record indicates a MEDIUM CVSS score of 5.3 and incomplete sanitization of sensitive user fields, allowing low-privilege authenticated accounts to access another user's video information. Defenders should prioritize verifying exposure and implementing compensating controls.

• Defenders should verify exposure and implement compensating controls to prevent unauthorized access to sensitive user information
• Security teams should monitor API requests and responses for potential abuse or unauthorized access
• Administrators of video sharing platforms should validate API requests and limit sensitive information disclosure

Technical summary

The AVideo API does not properly sanitize sensitive user fields in video responses, allowing low-privilege authenticated accounts to request another user's video and receive the owner's email address, account name, and certain flags. This vulnerability is caused by the API's failure to compare the User::getId() with the row's users_id, resulting in incomplete sanitization of sensitive user fields. The issue has a significant impact on the security of AVideo instances, particularly those with publicly accessible video sharing features.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the CVE record indicates a MEDIUM CVSS score of 5.3 and incomplete sanitization of sensitive user fields.

Recommended defensive actions

• Verify exposure by checking if the AVideo instance is vulnerable to this issue
• Implement compensating controls, such as validating API requests and limiting sensitive information disclosure
• Monitor API requests and responses for potential abuse or unauthorized access
• Review vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item indicate that AVideo's API does not properly sanitize sensitive user fields, allowing low-privilege authenticated accounts to access another user's video information. The NVD entry is currently Deferred.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.