EUVD-2026-277181

fkie_cve-2026-33685

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.php` endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (`reports.php`) and CSV export (`getCSV.php`) both correctly enforce `User::isAdmin()`, but the JSON API was left unprotected. Commit daca4ffb1ce19643eecaa044362c41ac2ce45dde contains a patch.

GHSA-j36m-74g2-7m95 — AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

Affected: Packagist: wwbn/avideo

## Summary

The `plugin/AD_Server/reports.json.php` endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (`reports.php`) and CSV export (`getCSV.php`) both correctly enforce `User::isAdmin()`, but the JSON API was left unprotected.

## Details

The vulnerable file `plugin/AD_Server/reports.json.php` loads the application configuration at line 5 but never checks whether the request comes from an authenticated admin user:

```php // plugin/AD_Server/reports.json.php:1-10 <?php header('Content-Type: application/json'); require_once '../../videos/configuration.php';

// Fetch request parameters with safety checks $startDate = !empty($_REQUEST['startDate']) ? $_REQUEST['startDate'] . ' 00:00:00' : null; $endDate = !empty($_REQUEST['endDate']) ? $_REQUEST['endDate'] . ' 23:59:59' : null; $reportType = isset($_REQUEST['reportType']) ? $_REQUEST['reportType'] : null; ```

Compare with the HTML page at `plugin/AD_Server/reports.php:6-8`, which correctly gates access:

```php if (!User::isAdmin()) { forbiddenPage(__("You cannot do this")); exit; } ```

And `plugin/AD_Server/getCSV.php:4-6`:

```php if (!User::isAdmin()) { forbiddenPage('You must be Admin'); } ```

The JSON endpoint exposes five report types, each querying joined tables that include user and video metada…

Most recent entries from all

EUVD-2026-277181

fkie_cve-2026-33685

GHSA-j36m-74g2-7m95 — AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data