CVE-2026-43881 AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
Unauthenticated attackers can enumerate all registered user accounts and retrieve personal details via flawed access controls in the user listing endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43881?
CVE-2026-43881 is a medium-severity vulnerability in WWBN AVideo, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter causes the handler to set $ignoreAdmin = true for any non-admin caller (including unauthenticated visitors), which defeats the admin-only guard inside User::getAllUsers()/User::getTotalUsers(). A second path accepts users_id and calls User::getUserFromID() directly with no permission check, producing a single-user oracle. Both paths return id, identification (display name), channel URL, photo, background, and status, plus the total account count. Commit d9cdc702481a626b15f814f6093f1e2a9c20d375 contains an updated fix.
Weakness: CWE-306
Which versions are affected by CVE-2026-43881?
2 open source packages ship an affected version, including wwbn/avideo.
| Package | Affected | Fixed in |
|---|---|---|
wwbn/avideo Packagist | All versions to 29.0 | None |
wwbn/avideo Packagist | All versions to 29.0 | None |
How do I fix CVE-2026-43881?
No fix has been published for CVE-2026-43881 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-43881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43881 exists.
Sources
Also known as GHSA-6rvw-7p8v-mjfq.