CVE-2026-126809 json
WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php
published 17h ago modified 12h ago also EUVD-2026-124024 , GHSA-g69x-xc9q-2g2v
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository WWBN/AVideo. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.
Patch / fix
Is CVE-2026-126809 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H |
| CNA | 4.0 | 6.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0
patch
-
github.com
/WWBN/AVideo/security/advisories/GHSA-g69x-xc9q-2g2v
vendor-advisory, advisory
-
github.com
/WWBN/AVideo/blob/v29.7.1/objects/import.json.php#L16-L81
technical-description
-
github.com
/WWBN/AVideo/blob/v29.7.1/objects/listFiles.json.php#L15-L35
technical-description
-
vulncheck.com
/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-objects-import-json-php
third-party-advisory
Sources
- CVE List CVE-2026-126809
- NVD CVE-2026-126809
- Maintainer advisory GHSA-g69x-xc9q-2g2v
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of WWBN/AVideo published their own advisory on GitHub. Reviewed sources take precedence over it.