What is CVE-2026-85156?

CVE-2026-85156 is a medium-severity vulnerability, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-09-03.

How severe is CVE-2026-85156?

Medium severity. CVSS v3 base score is 5.3 out of 10.

CVE-2026-85156

CVE-2026-85156

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.

Vulnerability class: Information Disclosure

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

disclosure@vulncheck.com
disclosure@vulncheck.com

Frequently asked questions

What is CVE-2026-85156?: CVE-2026-85156 is a medium-severity vulnerability, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-09-03.
How severe is CVE-2026-85156?: Medium severity. CVSS v3 base score is 5.3 out of 10.