WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform. This vulnerability is fixed in 25.0.

Affected: Packagist: wwbn/avideo

**Product:** AVideo (https://github.com/WWBN/AVideo) **Version:** Latest (tested March 2026) **Type:** Insecure Direct Object Reference (IDOR) **Auth Required:** No **User Interaction:** None

## Summary

The `/objects/playlistsFromUser.json.php` endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.

## Root Cause

The endpoint accepts a `users_id` parameter and directly queries the database without any authentication or authorization check. **File:** `objects/playlistsFromUser.json.php`

```php if (empty($_GET['users_id'])) { die("You need a user"); } // NO AUTHENTICATION CHECK // NO AUTHORIZATION CHECK (does this user_id belong to the requester?) $row = PlayList::getAllFromUser($_GET['users_id'], false); echo json_encode($row); ```

There is no call to `User::isLogged()` or any comparison between the requesting user and the target `users_id`.

## Affected Code

| File | Line | Issue | |------|------|-------| | `objects/playlistsFromUser.json.php` | 10-21 | No authentication or authorization check before returning playlist data |

## Proof of Concept

### Retrieve admin's playlists (user ID 1)

```bash curl "https://TARGET/objects/playlistsFromUser.json.php?users_id=1" ```

**Response:** ```json [ {"id":false,"name":"Watch Later","status":"watch_later","users…