CVE-2026-33501: Wwbn/avideo AVideo Has Unauthenticated Information Disclosure Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-96qp-8cmq-jvq8",
  "modified" : "2026-03-25T20:31:42Z",
  "published" : "2026-03-20T20:57:43Z",
  "aliases" : [ "CVE-2026-33501" ],
  "summary" : "AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin",
  "details" : "## Summary\n\nThe endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any authentication or authorization check, allowing unauthenticated users to retrieve the complete permission matrix mapping user groups to plugins. All sibling endpoints in the same directory (`add.json.php`, `delete.json.php`, `index.php`) properly require `User::isAdmin()`, indicating this is an oversight.\n\n## Details\n\nThe vulnerable file at `plugin/Permissions/View/Users_groups_permissions/list.json.php:1-7` contains:\n\n```php\n<?php\nrequire_once '../../../../videos/configuration.php';\nrequire_once $global['systemRootPath'] . 'plugin/Permissions/Objects/Users_groups_permissions.php';\nheader('Content-Type: application/json');\n\n$rows = Users_groups_permissions::getAll();\n?>\n{\"data\": <?php echo json_encode($rows); ?>}\n```\n\nThis calls `ObjectYPT::getAll()` (defined in `objects/Object.php:98-111`), which executes:\n\n```php\n$sql = \"SELECT * FROM  \" . static::getTableName() . \" WHERE 1=1 \";\n$sql .= self::getSqlFromPost();\n```\n\nThis returns all rows from the `users_groups_permissions` table as JSON with no access control.\n\nCompare with the sibling `add.json.php:10-15` and `delete.json.php:9-14`, which both enforce:\n\n```php\n$plugin = AVideoPlugin::loadPluginIfEnabled('Permissions');\nif(!User::isAdmin()){\n    $obj->msg = \"You cant do this\";\n    die(json_encode($obj));\n}\n```\n\nSimilarly, `index.php:6-8` (the admin page that loads this data via AJAX) checks:\n\n```php\nif (!User::isAdmin()) {\n    forbiddenPage(\"You can not do this\");\n    exit;\n}\n```\n\nNo `.htaccess` or web server configuration restricts direct access to this endpoint.\n\n## PoC\n\n```bash\n# Retrieve complete permission mappings without authentication\ncurl -s https://target/plugin/Permissions/View/Users_groups_permissions/list.json.php\n```\n\n**Expected response (admin-only data):**\n```json\n{\"data\": [{\"id\":\"1\",\"name\":null,\"users_groups_id\":\"2\",\"plugins_id\":\"5\",\"type\":\"1\",\"status\":\"a\"}, ...]}\n```\n\nEach row reveals:\n- `users_groups_id` — numeric ID of a user group\n- `plugins_id` — numeric ID of an installed plugin\n- `type` — the permission level granted\n- `status` — whether the permission is active (`a`) or inactive\n\nThe `getSqlFromPost()` method also processes `$_POST['sort']` and `$_GET` parameters, allowing an attacker to paginate and sort results to extract all data systematically.\n\n## Impact\n\nAn unauthenticated attacker can enumerate the complete authorization model of the AVideo instance:\n\n- **All user group IDs** and which plugins each group can access\n- **All installed plugin IDs** and their permission configurations\n- **Permission types and active/inactive status** for each group-plugin pair\n\nThis information provides a detailed roadmap of the application's authorization architecture, significantly aiding targeted privilege escalation, as an attacker would know exactly which groups have access to which plugins and what permission types are assigned. While not directly exploitable for data modification, it reduces the attacker's effort for follow-up attacks.\n\n## Recommended Fix\n\nAdd the same admin authorization check used by the sibling endpoints. In `plugin/Permissions/View/Users_groups_permissions/list.json.php`:\n\n```php\n<?php\nrequire_once '../../../../videos/configuration.php';\nrequire_once $global['systemRootPath'] . 'plugin/Permissions/Objects/Users_groups_permissions.php';\nheader('Content-Type: application/json');\n\n$plugin = AVideoPlugin::loadPluginIfEnabled('Permissions');\nif(!User::isAdmin()){\n    die(json_encode(['error' => true, 'msg' => 'You cant do this']));\n}\n\n$rows = Users_groups_permissions::getAll();\n?>\n{\"data\": <?php echo json_encode($rows); ?>}\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "wwbn/avideo"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "26.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/security/advisories/GHSA-96qp-8cmq-jvq8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33501"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/commit/b583acdc9a9d1eab461543caa363e1a104fb4516"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/commit/dc3c825734628bb32550d0daa125f05bacb6829c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/WWBN/AVideo"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-20T20:57:43Z",
    "nvd_published_at" : "2026-03-23T17:16:51Z"
  }
}