Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:53.187Z",
  "pubdate": "2026-09-12T13:16:53.187Z",
  "executiveSummary": "The WWBN AVideo platform exhibits an improper access control vulnerability within the ImageGallery module, specifically the list.json.php endpoint. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms designed to restrict access to image galleries.\nBy interacting directly with the vulnerable endpoint, an attacker can enumerate the file structures and retrieve sensitive URLs associated with image galleries, including those intended to be password-protected.\nThis vulnerability effectively renders file-level permission controls obsolete, leading to unauthorized information disclosure. The exposure of internal metadata and direct file paths facilitates the unauthorized acquisition of protected content. Impacted versions include all AVideo releases up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe risk is categorized as significant, as the exploitation requires no prior authentication or administrative privileges, exposing protected assets to any actor with network access to the target instance.",
  "technicalDetails": "The vulnerability resides in the ImageGallery plugin of the WWBN AVideo application, specifically in the file-handling logic processed by 'list.json.php'. The root cause is a failure to enforce session or permission validation within the script before it executes its directory listing or file retrieval logic.\nIn a secure implementation, the application should verify the user's authorization status—ensuring they possess appropriate privileges or satisfy password-protection requirements—before serving metadata about gallery contents. However, the 'list.json.php' endpoint processes requests without checking for an active session or a valid authentication token, resulting in a Broken Access Control (BAC) condition.\nThe attack flow follows a direct, unauthenticated HTTP GET request to the 'list.json.php' path. When the server receives this request, the script initiates a scan of the image gallery storage directory. It proceeds to generate a JSON response containing the full filenames, paths, and URLs for all available images, regardless of whether the gallery's access flag is set to public or restricted. Because the endpoint does not validate the request context, it serves this sensitive metadata to any external requester.\nOnce the attacker successfully retrieves the JSON payload, they gain visibility into the structure and naming conventions of the image repository. Using the paths obtained from the initial request, the attacker can then access the underlying image files directly through the web server. Since the application fails to enforce authorization even during the subsequent file retrieval process, the protected content is fully exposed. This allows for the mass harvesting of restricted media files without the need to supply the gallery's configured password.\nThe exposure is not restricted by network architecture, as the web endpoint is accessible via standard HTTP/HTTPS protocols. The lack of server-side authorization checks ensures that the application behaves as an open directory for the ImageGallery plugin, representing a failure in the application's secure coding practices regarding user-role verification."
}