The vulnerability allows an attacker to query the endpoint "plugin/Permissions/View/Users_groups_permissions/list.json.php" without any authentication or authorization check. This results in the disclosure of the entire permission matrix that maps user groups to plugin capabilities. Because the data reveals which plugins are enabled for each group, an attacker could plan targeted attacks or attempt privilege escalation based on available functionalities. The weakness is a classic example of insufficient privilege checks (CWE-862).

The issue affects the AVideo video platform developed by WWBN, specifically all releases up to and including version 26.0. Users running these versions are at risk unless they apply the available patch or upgrade to a newer release that contains the fix.

The CVSS Base Score of 5.3 indicates moderate severity, and the EPSS Score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known. Attackers could reach the vulnerable endpoint directly over HTTP/HTTPS from anywhere, requiring no credentials. Once accessed, the endpoint returns full permission mappings in JSON format, allowing straightforward data extraction. Consequently, the risk is moderate for exposed data and low for immediate exploitation, but the lack of authentication makes it trivial for a determined adversary.