CVE-2026-92586 — AVideo through 29.0 Missing Authorization via comment API endpoint
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to p…
Published: 2026-09-16 · CVSS: 5.3 · CVSS 4.0
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7