CVE-2026-92915 WWBN CVE debrief

Who should care

Defenders responsible for WWBN AVideo deployments should assess exposure and implement compensating controls to prevent exploitation. This includes verifying exposure, reviewing compensating controls for exposed systems, and monitoring for suspicious activity.

Why it matters

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows for account enumeration and potential password recovery token exploitation in WWBN AVideo deployments.

• Account enumeration and verification status disclosure
• Potential password recovery token exploitation
• Unintended verification email flooding
• Lack of rate limiting on verification email requests

Technical summary

The vulnerability is caused by a broken access control flaw in objects/userVerifyEmail.php, which allows unauthenticated remote attackers to send arbitrary verification emails and write live password-recovery tokens to targeted accounts. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows for account enumeration and potential password recovery token exploitation.

Recommended defensive actions

• Verify exposure by checking for affected versions and configurations
• Implement compensating controls, such as rate limiting and IP blocking
• Monitor for suspicious activity, such as unusual verification email requests
• Consider applying a patch or workaround, if available
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a broken access control flaw in objects/userVerifyEmail.php, which allows unauthenticated remote attackers to send arbitrary verification emails and write live password-recovery tokens to targeted accounts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.