The vulnerability resides in WWBN AVideo’s ImageGallery list.json.php endpoint, where the application fails to validate user permissions, enabling an unauthenticated user to read the list of filenames and URLs for galleries marked as password‑protected. This is an instance of CWE-200 (Information Exposure) and results in a confidentiality impact, exposing the location of private image files that were intended to be protected.

The affected product is WWBN AVideo, versions up through the commit c3edcc274c389816d434acadac07ee78eaf330c1. The issue appears in any deployment that exposes the ImageGallery list.json.php endpoint to the public web. Users running older releases that have not applied the authorization patch are susceptible.

The CVSS score of 6.9 indicates a moderate to high severity, while an EPSS score is currently unavailable; the vulnerability is not listed in the CISA KEV catalogue. Because the endpoint is reachable without credentials and is straightforward for attackers with network access to the web server. Once the file paths are obtained, the attacker can download the image files directly, gaining confidential data that was intended to be protected.