Avideo EUVD-2026-16732

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network-accessible information disclosure with no authentication required and low attack complexity-a straightforward exploitation path. However, the scope is limited to confidentiality impact only; no integrity or availability impact is present. Real-world risk is moderate: category metadata disclosure enables reconnaissance for further attacks (identifying restricted groups, understanding content organization) but does not directly compromise video content or user credentials. The SSVC framework would classify this as having limited technical impact due to the scope constraint to category metadata. The availability of a upstream fix (commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9) in the public repository suggests vendor awareness and remediation readiness. Exploitation requires only HTTP GET requests to a standard API endpoint, making automation trivial. Organizations running unpatched 26.0 or earlier should prioritize patching, but the vulnerability poses lower risk than code execution or data exfiltration issues.

An unauthenticated attacker on the internet crafts a simple HTTP GET request to the categories.json.php endpoint (e.g., http://target.com/categories.json.php) and receives a JSON response containing all non-private categories, including those explicitly restricted to specific user groups. By iterating with the ?user= parameter across different user IDs, the attacker exploits the type confusion bug to consistently retrieve the admin user's visible categories, mapping the platform's content structure and identifying which restricted user groups exist. This reconnaissance enables social engineering or targeted attacks against specific user groups without requiring any authentication credentials.