fkie_cve-2026-33501

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any authentication or authorization check, allowing unauthenticated users to retrieve the complete permission matrix mapping user groups to plugins. All sibling endpoints in the same directory (`add.json.php`, `delete.json.php`, `index.php`) properly require `User::isAdmin()`, indicating this is an oversight. Commits dc3c825734628bb32550d0daa125f05bacb6829c and b583acdc9a9d1eab461543caa363e1a104fb4516 contain patches.

GHSA-96qp-8cmq-jvq8 — AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

Affected: Packagist: wwbn/avideo

## Summary

The endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any authentication or authorization check, allowing unauthenticated users to retrieve the complete permission matrix mapping user groups to plugins. All sibling endpoints in the same directory (`add.json.php`, `delete.json.php`, `index.php`) properly require `User::isAdmin()`, indicating this is an oversight.

## Details

The vulnerable file at `plugin/Permissions/View/Users_groups_permissions/list.json.php:1-7` contains:

```php <?php require_once '../../../../videos/configuration.php'; require_once $global['systemRootPath'] . 'plugin/Permissions/Objects/Users_groups_permissions.php'; header('Content-Type: application/json');

$rows = Users_groups_permissions::getAll(); ?> {"data": <?php echo json_encode($rows); ?>} ```

This calls `ObjectYPT::getAll()` (defined in `objects/Object.php:98-111`), which executes:

```php $sql = "SELECT * FROM " . static::getTableName() . " WHERE 1=1 "; $sql .= self::getSqlFromPost(); ```

This returns all rows from the `users_groups_permissions` table as JSON with no access control.

Compare with the sibling `add.json.php:10-15` and `delete.json.php:9-14`, which both enforce:

```php $plugin = AVideoPlugin::loadPluginIfEnabled('Permissions'); if(!User::isAdmin()){ $obj->msg = "You cant do this"; die(json_encode($obj)); } ```

Similarly, `index.php:6-8` (the admin page that loads this data via AJAX) checks:

```php if (!User::isAdmin()) {…

Most recent entries from all

fkie_cve-2026-33501

GHSA-96qp-8cmq-jvq8 — AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin