The vulnerability exists in the categories.json.php endpoint of the WWBN AVideo platform. The endpoint is intended to list categories with user‑group‑based access control. In affected versions (up to 26.0), the access check is bypassed when no user parameter is supplied, and even when a user parameter is supplied, a type confusion bug causes the filter to use the admin user’s group memberships. This results in the exposure of all non‑private categories, including those that should be restricted to specific user groups. The weakness is a missing or broken access control (CWE‑863) that allows an attacker to gather information about restricted content without proper authorization.

The affected product is the WWBN AVideo platform. Versions up to and including 26.0 are impacted. The vulnerability affects the categories.json.php endpoint that serves the category listing API.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Because the categories.json.php endpoint can be invoked without authentication, an attacker can easily request the API and observe the unfiltered category list. The attack vector is by sending HTTP GET requests to categories.json.php, optionally with a user query string. No further exploitation steps are required. The lack of authentication combined with the missing access control makes the vulnerability straightforward to exploit, leading to unauthorized disclosure of category metadata.