Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck
CVE-2026-90548WWBN AVideo Missing Authorization in ImageGallery list.json.php
Medium 5.3
In plain English
A medium-severity information exposure in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-vr35-39vf-9qp9) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Missing Authorization in ImageGallery list.json.php third-party-advisory