AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

概要

objects/mention.json.php:17     $ignoreAdmin = true;
objects/mention.json.php:18     $users = User::getAllUsers($ignoreAdmin,
                                    ['name', 'email', 'user', 'channelName'], 'a');

参考情報

• WWBN/AVideo security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-45620 · ADVISORY
• WWBN/AVideo · PACKAGE
• GitHub Advisory GHSA-6rvw-7p8v-mjfq · ADVISORY

WWBN/AVideo のその他の脆弱性

• CVE-2026-54458緊急 9.6WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocke…
• CVE-2026-50183中 4.7WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI …
• CVE-2026-50182中 6.1WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo Y…
• CVE-2026-56345高 8.1AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives t…
• CVE-2026-47696中 4.3WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's …