AVideo存在未认证的IDOR - 播放列表信息泄露

The primary impact of CVE-2026-30885 is the exposure of sensitive playlist data. An attacker can leverage this vulnerability to discover user IDs and access details about their playlists, including the videos they contain and their status. While the vulnerability does not directly lead to data modification or system compromise, the enumeration of user accounts can be a precursor to further attacks, such as social engineering or targeted phishing campaigns. The lack of authentication requirements significantly broadens the attack surface, making it accessible to a wide range of threat actors.

Organizations utilizing AVideo for video management, particularly those with publicly accessible instances or those lacking robust access controls, are at risk. Shared hosting environments where multiple users share the same AVideo instance are especially vulnerable, as an attacker could potentially enumerate the playlists of other users.

• generic web: Use curl to test endpoint exposure:

curl http://<avideo_server>/objects/playlistsFromUser.json.php

If the endpoint returns playlist data without authentication, the vulnerability is likely present. • php: Examine the /objects/playlistsFromUser.json.php file for insecure direct object reference logic. Look for code that directly uses the users_id parameter without proper validation or authorization checks. • generic web: Review access/error logs for requests to /objects/playlistsFromUser.json.php originating from unexpected IP addresses.

1. 2026-03-07Disclosure

   disclosure

最后更新

29.0最近

1. 已保留2026-03-06
2. 发布日期2026-03-07
3. 修改日期2026-03-10
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-30885 is to upgrade AVideo to version 25.0 or later, which includes the necessary fix. As a temporary workaround, access to the /objects/playlistsFromUser.json.php endpoint can be restricted using web application firewall (WAF) rules or proxy configurations to require authentication. Carefully review and restrict access to all endpoints handling user data to prevent similar vulnerabilities in the future. After upgrading, confirm the fix by attempting to access the /objects/playlistsFromUser.json.php endpoint without authentication; access should be denied.