Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter. Attackers can retrieve hidden menu item URLs including embedded admin-tool secret query parameters not exposed in the public navbar.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:51.943Z",
  "pubdate": "2026-09-12T13:16:51.943Z",
  "executiveSummary": "WWBN AVideo, up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, is affected by an improper access control vulnerability located in the plugin/TopMenu/menuItems.json.php endpoint.\nThe vulnerability allows unauthenticated remote attackers to bypass authorization checks and retrieve sensitive configuration data, specifically hidden or inactive administrative menu items.\nBy manipulating the menuId parameter in a POST request, an attacker can extract full URLs and associated secret query parameters intended for administrative use only.\nThis exposure of internal paths and privileged tokens significantly increases the risk of unauthorized administrative access, privilege escalation, or further exploitation of administrative back-end tools.\nThe vulnerability requires no authentication, making it trivial for external actors to probe the system for hidden management endpoints.\nThe primary impact is the unauthorized disclosure of sensitive internal application infrastructure and administrative secrets.",
  "technicalDetails": "The vulnerability resides within the TopMenu plugin, specifically in the file plugin/TopMenu/menuItems.json.php. The root cause is a failure to enforce authentication or session-based authorization controls prior to processing user-supplied input.\nThe application logic fails to validate the request origin or the user's privilege level before querying the underlying menu data structure. When a POST request is received containing the 'menuId' parameter, the script retrieves the corresponding entry from the data store and renders the menu item's attributes—including URLs and query string parameters—directly into the JSON response.\nIn a secure configuration, administrative menu items—particularly those containing sensitive secret query parameters used for identifying and accessing internal administrative toolsets—should remain hidden from the client-side representation for unprivileged users. However, because the endpoint does not verify the requester's identity, an attacker can iterate through potential 'menuId' values to systematically enumerate internal system routes.\nThe attack flow follows a direct exploitation pattern: 1) The attacker initiates a standard POST request directed at the plugin/TopMenu/menuItems.json.php endpoint. 2) The attacker injects a 'menuId' parameter into the request body. 3) The server-side script retrieves the requested object, which may include sensitive internal URLs or administrative tokens embedded in the query string. 4) The server returns the requested information in cleartext JSON format. 5) The attacker parses this response to extract administrative secrets and hidden endpoint locations.\nThis vulnerability is classified as an authorization bypass resulting in sensitive information disclosure. The exploitation surface is external and reachable over the network without requiring any prior system access or valid user credentials. Post-exploitation impact involves the mapping of the administrative surface area, providing the attacker with the necessary data to target or bypass higher-level security controls integrated into the AVideo platform's management interfaces."
}