AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

보통 5.3CVE-2026-45620 · GHSA-vpfx-pxqw-2w79 · Published 29/05/2026 · updated 21/07/2026

요약

CVE-2026-45620은(는) WWBN/AVideo, avideo (wwbn)에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.19%, 전체 취약점의 9.0%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
WWBN/AVideo Packagist	`≤ 29.0`	No fix yet
avideo wwbn	`≤ 29.0`	No fix yet

Description

CVE-2026-43881 fix d9cdc7024 patched users.json.php only. The same anti-pattern survives at master HEAD in:

objects/mention.json.php:17     $ignoreAdmin = true;
objects/mention.json.php:18     $users = User::getAllUsers($ignoreAdmin,
                                    ['name', 'email', 'user', 'channelName'], 'a');

No User::loginCheck(), no admin gate. Only entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10.

NVD description

WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10. This enables unauthenticated user enumeration.

References

WWBN/AVideo security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-45620 · ADVISORY
WWBN/AVideo · PACKAGE
GitHub Advisory GHSA-6rvw-7p8v-mjfq · ADVISORY

WWBN/AVideo의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

WWBN/AVideo

Packagist

≤ 29.0

No fix yet

avideo

wwbn

≤ 29.0

No fix yet

Description

CVE-2026-43881 fix d9cdc7024 patched users.json.php only. The same anti-pattern survives at master HEAD in:

objects/mention.json.php:17     $ignoreAdmin = true;
objects/mention.json.php:18     $users = User::getAllUsers($ignoreAdmin,
                                    ['name', 'email', 'user', 'channelName'], 'a');

No User::loginCheck(), no admin gate. Only entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10.

NVD description

WWBN/AVideo의 다른 취약점

모두 보기 →