WWBN AVideo EUVD-2026-76857

No special conditions - unauthenticated remote exploitation against any network-accessible AVideo instance through commit c3edcc274c. The attacker only requires HTTP/HTTPS access to the AVideo web server and knowledge of the endpoint path (plugin/TopMenu/menuItems.json.php). Exploitation is limited by: (1) the direct impact is read-only access to menu item metadata rather than full admin control; (2) the value of the leaked secrets depends on whether downstream admin tools enforce their own authentication independently; (3) AVideo is a self-hosted platform, so external internet exposure depends on the operator's deployment choice.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects the low direct confidentiality impact - this does not yield RCE or privilege escalation on its own. The realistic threat is chained exploitation: an attacker first harvests the secret admin-tool parameters via this endpoint, then uses those parameters to access or invoke admin functionality that would otherwise require knowledge of unpublished URL patterns. Whether those downstream admin tools enforce proper authentication independently is the critical unknown. No KEV listing, no EPSS data, and no public POC are available, suggesting this has not been mass-exploited. The risk is elevated for internet-facing AVideo instances where admin tools rely on URL-embedded secrets as a partial access control mechanism.

An unauthenticated attacker sends a crafted POST request to https://target-avideo-instance/plugin/TopMenu/menuItems.json.php with a menuId parameter (iterating common or guessed values). The server responds with JSON containing inactive admin menu item definitions, including URLs with embedded secret query parameters such as admin API keys or tool-access nonces. The attacker then uses one of those URLs directly to invoke a privileged admin function without needing a valid session.