https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-02T22:46:47.599979+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-92586 CVE-2026-92586 — AVideo through 29.0 Missing Authorization via comment API endpoint 2026-10-02T22:46:47.601526+00:00

Affected: WWBN AVideo

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.