CVE-2026-34364: 
PHP vulnerability analysis and mitigation

CVE-2026-34364 is an Incorrect Authorization vulnerability in WWBN AVideo, an open source video platform, affecting all versions up to and including 26.0. The flaw resides in the categories.json.php API endpoint, which fails to enforce user group-based access controls, allowing unauthenticated attackers to enumerate restricted category metadata. The vulnerability was published on March 27, 2026, with a patch commit available shortly after. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, GHSA Advisory).

The vulnerability (CWE-863: Incorrect Authorization) has two distinct failure modes in objects/categories.json.php and objects/category.php. First, when no ?user= parameter is provided, $sameUserGroupAsMe defaults to false, causing the entire user group filter block in category.php to be skipped — returning all non-private categories regardless of group restrictions. Second, when ?user= is supplied, $sameUserGroupAsMe is set to boolean true, which PHP casts to integer 1 when passed to UserGroups::getUserGroups(), resulting in a WHERE users_id = 1 query that fetches the admin user's group memberships instead of the requesting user's. Additionally, getTotalCategories() did not accept a $sameUserGroupAsMe parameter at all, so category counts were always unfiltered. The endpoint is publicly routable via an .htaccess rewrite rule and requires no authentication (GHSA Advisory, Patch Commit).

Successful exploitation allows any unauthenticated network attacker to enumerate all non-private categories on an AVideo instance, including those explicitly restricted to specific user groups via the categories_has_users_groups table. The response also exposes the users_groups_ids_array field, revealing the internal access control structure — which groups are assigned to which categories. While actual video content is not directly exposed, this information disclosure of category metadata and group assignments could facilitate targeted follow-on attacks against other access control weaknesses. Integrity and availability are not impacted (GHSA Advisory).

A proof-of-concept exploit consisting of simple curl commands is publicly documented in the official GitHub security advisory, requiring no authentication or special tooling. The EPSS score is approximately 0.018% (low probability of near-term exploitation), and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, GHSA Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to the target's /categories.json endpoint.
2. Enumerate all categories (no-auth, no filtering): Send an unauthenticated GET request to the public endpoint without any parameters:

   curl -s 'https://target/categories.json' | jq '.rows[] | {id, name, private, users_groups_ids_array}'

   This returns all non-private categories, including those restricted to specific user groups, because group filtering is entirely skipped.
3. Exploit the broken filtered path (admin group leak): Send a request with the ?user= parameter to trigger the type confusion bug:

   curl -s 'https://target/categories.json?user=1' | jq '.rows[] | {id, name, private, users_groups_ids_array}'

   PHP casts true to 1, causing the filter to apply admin group memberships, exposing categories visible to the admin.
4. Map access control structure: Analyze the users_groups_ids_array field in responses to identify which categories are restricted to which user groups, building a map of the platform's internal access control configuration.
5. Use intelligence for further attacks: Leverage the enumerated category names, IDs, and group assignments to target further access control bypasses on video content within those restricted categories (GHSA Advisory).

• Network: Unauthenticated HTTP GET requests to /categories.json or /categories.json?user=1 (or any non-empty ?user= value) from external or unexpected IP addresses; high-frequency requests to this endpoint suggesting automated enumeration.
• Logs: Web server access logs showing repeated requests to categories.json or objects/categories.json.php without session cookies or authentication headers; requests with ?user= parameter values from unauthenticated sessions.
• Application Behavior: Unusually high category listing API response volumes; access to the endpoint from IP ranges not associated with legitimate users.

Apply the fix introduced in commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9, which modifies objects/categories.json.php to always pass the logged-in user's real integer ID (or -1 for guests) to getAllCategories(), and updates getTotalCategories() to accept and apply the same group filter. Administrators should upgrade to any AVideo release that includes this commit. As an interim workaround, consider restricting access to the /categories.json endpoint via web server configuration (e.g., requiring authentication at the reverse proxy level) until the patch can be applied. Additionally, review web server access logs for unauthorized access to the categories.json endpoint to assess potential prior exposure (GHSA Advisory, Patch Commit).