AVideo CVE-2026-92577

No authentication, user interaction, or special client configuration is required: an anonymous caller reaches the API get_api_video endpoint and triggers the clean_title branch by querying a video via its public slug. The primary prerequisite on the target side is that the AVideo instance (version through 29.0) actually hosts videos restricted to user groups whose owners have PII populated (email, phone, address, birth date) - instances with no group-restricted content or empty profile fields yield little. Limiting factors are the niche deployment footprint and the confidentiality-only impact (no write/RCE); the attacker must also know or enumerate valid public slugs, though these are by design publicly referenceable.

The signals are largely consistent and point to a genuine, easy-to-exploit information-disclosure flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes remote, unauthenticated, low-complexity access with high confidentiality impact and no integrity/availability effect - matching the description of an anonymous caller pulling owner PII. I concur with the confidentiality-only shape; my independent CVSS 3.1 mapping is ~7.5 (C:H, I:N, A:N), so the 4.0 8.7 mainly reflects 4.0's harsher weighting of unauthenticated network confidentiality loss rather than any integrity/availability impact the description does not support. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active exploitation or automated weaponization at this time - this is a high-scoring but not-yet-exploited issue whose real risk is driven by how trivial the request is (public slug → PII) rather than by observed attacks. Note the input Tag 'Authentication Bypass' conflicts with CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): this is a broken-access-control / authorization defect, not an authentication bypass. Priority should be moderate-to-high for operators actually running AVideo with user-group-restricted content, and lower elsewhere given the niche footprint and absence of exploitation signals.

An anonymous attacker enumerates or guesses the public slug of a group-restricted video and calls the get_api_video endpoint's clean_title branch, receiving the video object along with the owner's email, phone, address, birth date, and administrator flag. No login, user interaction, or special configuration is required, so the request is a single unauthenticated HTTP call; no public exploit code is identified at time of analysis, but the technique is trivial to reproduce.