{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-61571",
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "state": "PUBLISHED",
        "assignerShortName": "GitHub_M",
        "dateReserved": "2026-07-10T16:48:39.924Z",
        "datePublished": "2026-10-28T21:49:16.840Z",
        "dateUpdated": "2026-10-28T21:49:16.840Z"
    },
    "containers": {
        "cna": {
            "title": "AVideo-Encoder: missing authentication on control and status endpoints",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-306",
                            "lang": "en",
                            "description": "CWE-306: Missing Authentication for Critical Function",
                            "type": "CWE"
                        }
                    ]
                },
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-862",
                            "lang": "en",
                            "description": "CWE-862: Missing Authorization",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "LOW",
                        "baseScore": 7.3,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "LOW",
                        "integrityImpact": "LOW",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                        "version": "3.1"
                    }
                }
            ],
            "references": [
                {
                    "name": "https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-297p-4mj8-28wm",
                    "tags": [
                        "x_refsource_CONFIRM"
                    ],
                    "url": "https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-297p-4mj8-28wm"
                },
                {
                    "name": "https://github.com/WWBN/AVideo-Encoder/commit/ac6097cd5fa7a24df82293bff66b136d559c16db",
                    "tags": [
                        "x_refsource_MISC"
                    ],
                    "url": "https://github.com/WWBN/AVideo-Encoder/commit/ac6097cd5fa7a24df82293bff66b136d559c16db"
                },
                {
                    "name": "https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0",
                    "tags": [
                        "x_refsource_MISC"
                    ],
                    "url": "https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0"
                }
            ],
            "affected": [
                {
                    "vendor": "WWBN",
                    "product": "AVideo-Encoder",
                    "versions": [
                        {
                            "version": "< 8.1.0",
                            "status": "affected"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
                "shortName": "GitHub_M",
                "dateUpdated": "2026-10-28T21:49:16.840Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs through `getSiteURL()`, and triggers processing with `execRun()`. `view/status.php` returns `Access-Control-Allow-Origin` with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is set. `view/listFiles.json.php` checks only `Login::canBulkEncode()`, which admits anonymous callers whenever `disableBulkEncode` is empty, the default. Its `path` parameter is resolved with `realpath()` and listed with `scandir()` without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0."
                }
            ],
            "source": {
                "advisory": "GHSA-297p-4mj8-28wm",
                "discovery": "UNKNOWN"
            }
        }
    }
}