Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:52.220Z",
  "pubdate": "2026-09-12T13:16:52.220Z",
  "executiveSummary": "WWBN AVideo contains an improper authorization vulnerability within the TopMenu plugin, specifically located at the plugin/TopMenu/menus.json.php endpoint.\nThe vulnerability allows remote, unauthenticated attackers to retrieve sensitive menu configuration data, including items intended only for administrative use or currently marked as inactive.\nThe root cause is a lack of mandatory authentication checks within the PHP script handling the menu data retrieval.\nThis exposure poses a significant risk to information confidentiality, as it allows unauthorized users to map the application's administrative structure and identify hidden or private navigation elements that are otherwise obfuscated from the public-facing UI.\nExploitation requires no special privileges or prior authentication, merely the ability to send a standard HTTP GET request to the vulnerable endpoint.\nThe vulnerability affects all versions of AVideo up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1.",
  "technicalDetails": "The vulnerability resides within the TopMenu plugin of the WWBN AVideo platform, specifically targeting the file located at plugin/TopMenu/menus.json.php.\nThe technical root cause is an access control failure: the script responsible for rendering menu data in JSON format fails to invoke the application's authentication middleware or verify the requester's session status prior to executing the data retrieval logic.\nIn a secure configuration, administrative and inactive menu items should be gated by a session check verifying the user's role and privileges. However, the current implementation blindly iterates through the stored menu structure and outputs all associated entries in a JSON response regardless of the user's authentication context.\nThe attack flow is trivial: an attacker performs a network-based reconnaissance of the target AVideo installation. By sending a crafted HTTP GET request to the target URI 'plugin/TopMenu/menus.json.php', the application server processes the request and returns the full JSON object containing all menu definitions. This includes navigation items that are purposefully hidden from the front-end interface, such as administrative dashboards, private configuration menus, or temporary/inactive plugins.\nThis vulnerability is classified as an Unauthenticated Information Disclosure. Because the endpoint does not perform server-side filtering based on the 'isAdmin()' function or equivalent security checks, the server inadvertently leaks the entire application navigation map to any unauthenticated actor.\nPost-exploitation, the attacker can use the discovered menu information to identify the existence of backend functionality, administrative endpoints, or sensitive plugin workflows. By identifying these hidden paths, an attacker can more effectively perform targeted follow-up attacks, such as attempting to access restricted URLs that were previously unknown to them. The network exposure is broad, as this endpoint is accessible via any network interface reachable by the AVideo application instance, requiring no complex payload injection or obfuscation to trigger the vulnerability."
}