CVE-2026-81732 WWBN AVideo through 30.0 Information Disclosure via report4.json.php
Unauthenticated attackers can access user registration statistics via exposed JSON endpoints in WWBN AVideo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81732?
CVE-2026-81732 is a medium-severity vulnerability in WWBN AVideo, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.
Weakness: CWE-200
Which versions are affected by CVE-2026-81732?
How do I fix CVE-2026-81732?
No fix has been published for CVE-2026-81732 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81732 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81732 exists.
Sources
Also known as GHSA-6c5p-vcp5-h6f3.