GHSA-6W2R-CFPC-23R5

Vulnerability from github – Published: 2026-03-07 02:25 – Updated: 2026-03-10 18:43
VLAI
Summary
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
Details

Product: AVideo (https://github.com/WWBN/AVideo) Version: Latest (tested March 2026) Type: Insecure Direct Object Reference (IDOR) Auth Required: No User Interaction: None

Summary

The /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.

Root Cause

The endpoint accepts a users_id parameter and directly queries the database without any authentication or authorization check. File: objects/playlistsFromUser.json.php

if (empty($_GET['users_id'])) {
    die("You need a user");
}
// NO AUTHENTICATION CHECK
// NO AUTHORIZATION CHECK (does this user_id belong to the requester?)
$row = PlayList::getAllFromUser($_GET['users_id'], false);
echo json_encode($row);

There is no call to User::isLogged() or any comparison between the requesting user and the target users_id.

Affected Code

File Line Issue
objects/playlistsFromUser.json.php 10-21 No authentication or authorization check before returning playlist data

Proof of Concept

Retrieve admin's playlists (user ID 1)

curl "https://TARGET/objects/playlistsFromUser.json.php?users_id=1"

Response:

[
  {"id":false,"name":"Watch Later","status":"watch_later","users_id":1},
  {"id":false,"name":"Favorite","status":"favorite","users_id":1}
]

image

Impact

  • Privacy violation — any visitor can see all users' playlist names and contents
  • User enumeration — valid user IDs can be discovered by iterating through IDs
  • Information gathering — playlist names and video IDs reveal user interests and private content preferences
  • Targeted attacks — gathered information can be used for social engineering or further exploitation

Remediation

Add authentication and authorization checks:

// Option 1: Require authentication + only own playlists
if (!User::isLogged()) {
    die(json_encode(['error' => 'Authentication required']));
}
if ($_GET['users_id'] != User::getId() && !User::isAdmin()) {
    die(json_encode(['error' => 'Access denied']));
}

// Option 2: If public playlists are intended, filter by visibility
$row = PlayList::getAllFromUser($_GET['users_id'], false, 'public');
Severity
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-07T02:25:48Z",
    "nvd_published_at": "2026-03-10T17:40:14Z",
    "severity": "MODERATE"
  },
  "details": "**Product:** AVideo (https://github.com/WWBN/AVideo)\n**Version:** Latest (tested March 2026)\n**Type:** Insecure Direct Object Reference (IDOR)\n**Auth Required:** No\n**User Interaction:** None\n\n## Summary\n\nThe `/objects/playlistsFromUser.json.php` endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.\n\n## Root Cause\n\nThe endpoint accepts a `users_id` parameter and directly queries the database without any authentication or authorization check.\n**File:** `objects/playlistsFromUser.json.php`\n\n```php\nif (empty($_GET[\u0027users_id\u0027])) {\n    die(\"You need a user\");\n}\n// NO AUTHENTICATION CHECK\n// NO AUTHORIZATION CHECK (does this user_id belong to the requester?)\n$row = PlayList::getAllFromUser($_GET[\u0027users_id\u0027], false);\necho json_encode($row);\n```\n\nThere is no call to `User::isLogged()` or any comparison between the requesting user and the target `users_id`.\n\n## Affected Code\n\n| File | Line | Issue |\n|------|------|-------|\n| `objects/playlistsFromUser.json.php` | 10-21 | No authentication or authorization check before returning playlist data |\n\n## Proof of Concept\n\n### Retrieve admin\u0027s playlists (user ID 1)\n\n```bash\ncurl \"https://TARGET/objects/playlistsFromUser.json.php?users_id=1\"\n```\n\n**Response:**\n```json\n[\n  {\"id\":false,\"name\":\"Watch Later\",\"status\":\"watch_later\",\"users_id\":1},\n  {\"id\":false,\"name\":\"Favorite\",\"status\":\"favorite\",\"users_id\":1}\n]\n```\n\n\u003cimg width=\"1805\" height=\"365\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a13c9c2f-29be-4399-98d2-7570ca30465a\" /\u003e\n\n\n## Impact\n\n- **Privacy violation** \u2014 any visitor can see all users\u0027 playlist names and contents\n- **User enumeration** \u2014 valid user IDs can be discovered by iterating through IDs\n- **Information gathering** \u2014 playlist names and video IDs reveal user interests and private content preferences\n- **Targeted attacks** \u2014 gathered information can be used for social engineering or further exploitation\n\n## Remediation\n\nAdd authentication and authorization checks:\n\n```php\n// Option 1: Require authentication + only own playlists\nif (!User::isLogged()) {\n    die(json_encode([\u0027error\u0027 =\u003e \u0027Authentication required\u0027]));\n}\nif ($_GET[\u0027users_id\u0027] != User::getId() \u0026\u0026 !User::isAdmin()) {\n    die(json_encode([\u0027error\u0027 =\u003e \u0027Access denied\u0027]));\n}\n\n// Option 2: If public playlists are intended, filter by visibility\n$row = PlayList::getAllFromUser($_GET[\u0027users_id\u0027], false, \u0027public\u0027);\n```",
  "id": "GHSA-6w2r-cfpc-23r5",
  "modified": "2026-03-10T18:43:57Z",
  "published": "2026-03-07T02:25:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30885"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/12adc66913724736937a61130ae2779c299445ca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AVideo has Unauthenticated IDOR - Playlist Information Disclosure"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.