CVE-2026-90541 WWBN CVE debrief

Who should care

Defenders responsible for AVideo deployments should assess exposure and prioritize remediation to prevent potential unauthorized access to menu data. This includes verifying the exposure of AVideo plugin/TopMenu/menus.json.php endpoint, restricting access to authenticated users, and monitoring for unauthorized access attempts. Security teams and vulnerability management teams should also review the vulnerability and plan for remediation.

Why it matters

The CVE-2026-90541 vulnerability in AVideo's plugin/TopMenu/menus.json.php endpoint allows unauthenticated attackers to retrieve menu data. Defenders should prioritize verifying exposure, restricting access, and monitoring for unauthorized access attempts.

• Potential unauthorized access to menu data
• Possible information disclosure
• Requires verification of endpoint exposure
• Prioritize authentication and access controls

Technical summary

The AVideo plugin/TopMenu/menus.json.php endpoint fails to require authentication, allowing unauthenticated attackers to retrieve all menu data, including inactive and admin-only menu names. This vulnerability impacts AVideo deployments, as it enables unauthenticated access to sensitive menu information. Defenders should assess the exposure of their AVideo instances and prioritize remediation to prevent potential unauthorized access to menu data. The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited.

Defensive priority

Defenders should prioritize verifying exposure of the AVideo plugin/TopMenu/menus.json.php endpoint and restrict access to authenticated users.

Recommended defensive actions

• Verify exposure of the AVideo plugin/TopMenu/menus.json.php endpoint
• Restrict access to authenticated users
• Monitor for unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information on affected versions and remediation is limited. Defenders should verify the exposure of AVideo plugin/TopMenu/menus.json.php endpoint and restrict access to authenticated users. The vulnerability allows unauthenticated attackers to retrieve all menu data, including inactive and admin-only menu names.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.