What is the CVSS score of CVE-2026-34364?

CVE-2026-34364 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34364?

Organizations using versions should be aware of moderate risk from CVE-2026-34364, a incorrect authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-34364?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-34364

EUVD-2026-16732 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-27 security-advisories@github.com

GHSA-73gr-r64q-7jh4

PHP Authentication Bypass

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 18:22 euvd

EUVD-2026-16732

Analysis Generated

Mar 27, 2026 - 18:22 vuln.today

CVE Published

Mar 27, 2026 - 18:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the categories.json.php endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no ?user= parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the ?user= parameter is supplied, a type confusion bug causes the filter to use the admin user's (user_id=1) group memberships instead of the current user's, rendering the filter ineffective. Commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9 contains a fix.

AnalysisAI

WWBN AVideo versions up to 26.0 expose all non-private video categories to unauthenticated remote attackers due to missing access control enforcement in the categories.json.php endpoint. The vulnerability combines two distinct flaws: complete bypass of group-based filtering when no user parameter is supplied, and a type confusion bug that substitutes the admin user's group memberships when a user parameter is present, allowing unauthorized disclosure of category metadata intended for restricted user groups. CVSS 5.3 reflects the information disclosure impact with no authentication required and low attack complexity; no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

WWBN AVideo is a PHP-based open-source video platform that implements user group-based access controls for content categorization. The vulnerability exists in the categories.json.php API endpoint, which processes optional query parameters to filter categories by user group membership. The root cause is classified under CWE-863 (Incorrect Authorization), a category encompassing failures to enforce access control policies. Two distinct code paths are affected: the default request path entirely skips group filtering logic, and the parameterized path (with ?user= parameter) contains a type confusion bug in which the filter incorrectly references the hard-coded admin user (user_id=1) group memberships rather than the requesting user's groups. This combination allows unauthenticated attackers to enumerate category metadata across all access levels.

RemediationAI

Upgrade WWBN AVideo to a version incorporating fix commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9 or later (consult the vendor release notes at https://github.com/WWBN/AVideo to confirm exact patched version number). Until patching is feasible, implement network-level access controls to restrict the categories.json.php endpoint to trusted internal IP ranges, and monitor API logs for unusual category enumeration patterns. If the deployment exposes AVideo to untrusted networks, apply a Web Application Firewall rule to block or require authentication for categories.json.php requests until the patch is deployed.