The vulnerability resides in the categories.json.php endpoint of the WWBN AVideo platform, which is responsible for providing a list of video categories. The code fails to enforce user group‑based access controls: with no user parameter the filter is entirely omitted, returning all non‑private categories, including those intended for specific groups. When a ?user= parameter is supplied a type‑confusion bug causes the filter to use the administrator’s group membership (user_id=1) instead of the requested user’s, rendering the restriction ineffective. In either case the end result is that categories that should be hidden from certain users become publicly listed, thereby permitting the disclosure of restricted grouping information. The description does not explicitly state whether authenticated or unauthenticated requests are required to reach the endpoint; based on the wording it is inferred that the API may be reachable without authentication, but the exact authentication model is not documented.

This flaw affects all released versions of WWBN AVideo up to and including 26.0. The affected component is the categories.json.php API, which serves the category listing data for the application.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests low likelihood of exploitation observed in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote HTTP requests directed at the categories.json.php endpoint; the attacker does not need to compromise the host or execute arbitrary code. The impact is confined to unauthorized information disclosure of categories and does not provide privilege escalation or further system compromise.