CVE-2026-92577 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, security teams, and administrators should assess exposure and prioritize mitigation to prevent unauthorized access to sensitive user data and video content. They should verify instance vulnerability, review compensating controls, and plan vendor-supported updates or mitigations through normal change control.

Why it matters

Defenders should care about CVE-2026-92577 because it allows unauthorized access to sensitive user data and video content in AVideo instances, potentially impacting user privacy and security. Security teams and administrators should assess exposure, prioritize mitigation, and verify instance vulnerability.

• Potential unauthorized access to sensitive user data
• Possible bypass of group restrictions on video content
• Need for verification of AVideo instance vulnerability
• Potential impact on user privacy and security

Technical summary

The AVideo API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch, allowing anonymous callers to retrieve user-group-restricted videos with owner PII, including email, phone, address, birth date, and administrator status. This vulnerability allows attackers to bypass group restrictions by querying videos by their public slug. Defenders should prioritize verifying and mitigating this vulnerability in AVideo instances, focusing on restricting access to sensitive video content and user data.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in AVideo instances, focusing on restricting access to sensitive video content and user data.

Recommended defensive actions

• Verify AVideo instance vulnerability and assess exposure to the get_api_video endpoint
• Restrict access to sensitive video content and user data
• Monitor for potential exploitation attempts
• Implement compensating controls for exposed systems
• Review asset inventory for affected product deployments
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Defenders should verify instance vulnerability, focusing on restricting access to sensitive video content and user data. The clean_title branch of the get_api_video endpoint is specifically mentioned as containing the broken access control vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.