The vulnerability resides in the playlistsFromUser.json.php endpoint of the WWBN AVideo application. An attacker can send a request to the endpoint with a user identifier of another account and receive the contents of that user's playlist. Because the request is not validated against the identity of the caller, unauthenticated users can read data that should be protected, resulting in a privacy breach for affected users. The weakness corresponds to improper authorization (CWE-200).

The flaw affects the WWBN AVideo platform at any version that includes the vulnerable commit c3edcc274c389816d434acadac07ee78eaf330c1. Administrators of AVideo installations that have not applied the latest security patch or upgrade from this commit are affected. The product is identified as AVideo by the vendor WWBN.

The CVSS score of 6.9 classifies the flaw as moderately severe. Attackers can exploit it remotely over the network as the endpoint is publicly reachable. The vulnerability does not require any authentication, so any network actor can craft a request with a target user’s identifier and retrieve their private playlist data. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating that there is no publicly documented exploitation at this time. Nevertheless, the lack of authentication presents a clear opportunity for privacy compromise.