What is the CVSS score of CVE-2026-90548?

CVE-2026-90548 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

WWBN AVideo CVE-2026-90548

EUVD-2026-76866 MEDIUM

Information Exposure (CWE-200)

2026-09-12 VulnCheck

GHSA-jcfh-7f2p-jv93

PHP Information Disclosure Avideo Wwbn

6.9

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify network-accessible AVideo instance
Exploit

Send unauthenticated GET to /plugin/ImageGallery/list.json.php
Execution

Receive JSON listing of gallery filenames and URLs
Impact

Download password-protected gallery images directly via exposed URLs

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions are required beyond a network-accessible AVideo installation where the ImageGallery plugin is installed and active. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms unauthenticated remote exploitation with no configuration complexity, no specific platform requirement, and no user interaction needed. Exploitation is limited by: (1) the ImageGallery plugin must be installed and enabled - operators not using this feature are not exposed; (2) the impact is strictly read-only disclosure of gallery file listings and image content - no code execution, privilege escalation, or write access is achievable through this vulnerability; and (3) only image files stored in AVideo's gallery feature are at risk, not other platform content or system files.
Impact	The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately represents a low-confidentiality-impact information disclosure that is trivially exploitable over the network without credentials - even a mid-sized municipal IT team in gdynia running AVideo for internal media management should treat this as a meaningful privacy control failure, since users may believe gallery passwords provide genuine access control when they do not. The absence of KEV listing and the lack of any referenced public exploit code reduce immediate operational urgency. No EPSS score is provided. The impact is strictly bounded to confidentiality of gallery file metadata and image content; VI:N/VA:N confirm no integrity or availability consequences are possible through this vector. Real-world risk is highest for organizations using AVideo's password-protected gallery feature to restrict access to sensitive image content, where the expectation of access control is entirely undermined.
Exploit ScenarioDerived	An unauthenticated external attacker sends an HTTP GET request directly to the target AVideo instance's /plugin/ImageGallery/list.json.php endpoint. The endpoint returns a JSON array containing filenames and direct download URLs for all configured galleries, including those marked as password-protected at the UI layer. The attacker then uses the returned URLs to download the image files directly from the server, completely bypassing the gallery password protection without ever needing to interact with the authentication UI.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 12, 2026

Missing authorization in WWBN AVideo's ImageGallery list.json.php endpoint allows unauthenticated attackers to enumerate password-protected gallery file listings and retrieve the exposed image files directly without credentials. All AVideo installations through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected when the ImageGallery plugin is active. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no technical sophistication and is trivially automatable.

RemediationAI

Patch available per vendor advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-vr35-39vf-9qp9. Operators should update AVideo to a commit incorporating the fix beyond c3edcc274c389816d434acadac07ee78eaf330c1; no specific patched release version number is identified in available data, so check the repository for the remediation commit. As a compensating control, restrict access to the ImageGallery list.json.php endpoint at the web server level using nginx location-block deny rules or Apache Require ip directives, limiting access to authenticated network segments only. Alternatively, disable the ImageGallery plugin entirely if it is not in active use. Note that web server ACL workarounds add an external layer but do not fix the underlying missing authorization logic; they should be considered temporary until the code-level fix is applied.

Affected VersionsENISA

AVideo 0 ≤c3edcc274c389816d434acadac07ee78eaf330c1

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WWBN AVideo is an open-source PHP-based video hosting and streaming platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from a missing permission validation check in the ImageGallery plugin's list.json.php endpoint. This endpoint is designed to return a JSON-formatted listing of gallery image files, but performs no session validation or role-based access check before responding. As a result, any network-accessible request receives the full file listing - including filenames and direct URLs - for galleries that are ostensibly protected by a gallery-level password. The password protection exists only at the UI presentation layer, not at the file-serving layer, meaning once filenames and URLs are disclosed through the unprotected listing endpoint, the underlying files can be fetched directly without further authentication.

Know when Avideo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 5.3 MEDIUM

Network-reachable endpoint requires no authentication; impact is limited to low confidentiality disclosure of gallery filenames and direct file URLs only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.

Threat Intelligence Overview

EPSS Score

0.2%

Top 86% exploitable

Prevalence

Low

self-hosted open-source video platform, limited enterprise adoption

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.