AVideo Information Disclosure Vulnerability via Public API

A vulnerability exists in AVideo versions prior to 20.0, where sensitive user information is exposed through an unauthenticated public API endpoint. This information includes emails, usernames, administrative status, and last login times, leading to user enumeration and privacy violations.

Impact

The vulnerability allows for unauthorized access to sensitive user information, including personal identification details and administrative status, which could be misused for privacy violations or social engineering attacks.

Reproduction

The vulnerability can be reproduced by sending a request to the public API endpoint without authentication. The response will include sensitive user information such as email addresses, usernames, admin status, and last login times.

Remediation

Users can upgrade to AVideo version 20.0 or later, where this vulnerability has been addressed.