The vulnerability is an IDOR in the AI plugin’s save.json.php endpoint that permits an authenticated user with AI permissions to load AI response objects for any specified video ID without validating ownership. This flaw allows the user to read and apply titles, descriptions, keywords, summaries, or full transcriptions that belong to other users’ private videos, effectively exfiltrating sensitive metadata generated from the original content.

WWBN AVideo, an open‑source video platform, versions up to and including 26.0 are affected. The issue resides within the AI plugin and its save.json.php endpoint.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA known‑exploited vulnerability catalog. Exploitation requires the attacker to be an authenticated user with AI permissions; no unauthenticated or privilege escalation path is documented. The attack vector is limited to legitimate user interactions, making internal monitoring and permission control critical for risk mitigation.