Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| WWBN | AVideo | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-99j6-hj87-6fcf | AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php |
References
History
Tue, 07 Apr 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata. | |
| Title | WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php | |
| Weaknesses | CWE-200 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-06T21:47:45.511Z
Reserved: 2026-04-02T19:25:52.192Z
Link: CVE-2026-35452
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-06T22:16:23.610
Modified: 2026-04-06T22:16:23.610
Link: CVE-2026-35452
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses