The plugin/TopMenu/menuItems.json.php endpoint in AVideo is exposed without authentication, allowing an attacker to send a POST request with a menuId parameter and retrieve a JSON response that includes references to inactive admin menu items. These items contain URLs and embedded secret query parameters that are normally hidden from the public navigation bar. The result is a disclosure of internal administrative links that could aid in planning further privileged attacks. The weakness is classified as CWE-200.

The vulnerability affects the WWBN AVideo platform. It has been identified in the code committed as c3edcc274c389816d434acadac07ee78eaf330c1. Earlier commits are not explicitly listed but may also be impacted if the same endpoint lacks authentication checks.

The CVSS base score is 6.9, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting moderate exploitation likelihood but no confirmed widespread use. The attack vector is remote, requiring only network access to the AVideo server to submit a POST request to the vulnerable endpoint. The lack of authentication checks makes exploitation straightforward for any adversary able to reach the endpoint.