{"id":"CVE-2026-61571","aliases":[],"cve":{"records":[{"id":"CVE-2026-61571","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T16:48:39.924Z","published":"2026-10-28T21:49:16.840Z","modified":"2026-10-28T21:49:16.840Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-28T21:49:16.840Z"}],"references":[{"url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-297p-4mj8-28wm","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/WWBN/AVideo-Encoder/commit/ac6097cd5fa7a24df82293bff66b136d559c16db","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-306","description":"CWE-306: Missing Authentication for Critical Function","source":"GitHub_M"},{"id":"CWE-862","description":"CWE-862: Missing Authorization","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"AVideo-Encoder: missing authentication on control and status endpoints","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs through `getSiteURL()`, and triggers processing with `execRun()`. `view/status.php` returns `Access-Control-Allow-Origin` with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is set. `view/listFiles.json.php` checks only `Login::canBulkEncode()`, which admits anonymous callers whenever `disableBulkEncode` is empty, the default. Its `path` parameter is resolved with `realpath()` and listed with `scandir()` without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.","score":7.3,"severity":"high","published":"2026-10-28T21:49:16.840Z","modified":"2026-10-28T21:49:16.840Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"WWBN","name":"AVideo-Encoder","platforms":[],"versions":[{"version":"< 8.1.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61571"}],"remediation":[],"references":["https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-297p-4mj8-28wm","https://github.com/WWBN/AVideo-Encoder/commit/ac6097cd5fa7a24df82293bff66b136d559c16db","https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0"],"sources":[{"name":"CVE","id":"CVE-2026-61571","modified":"2026-10-28T21:49:16.840Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61571"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:41:01.747Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T03:05:31.332Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T22:45:34.684Z","attemptedAt":"2026-10-28T22:45:34.684Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T22:45:34.372Z","attemptedAt":"2026-10-28T22:45:34.372Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T22:45:34.888Z","attemptedAt":"2026-10-28T22:45:34.888Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T22:45:33.901Z","attemptedAt":"2026-10-28T22:45:33.901Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-61571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61571","modified":"2026-10-28T22:17:16.193","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","checkedAt":"2026-10-28T22:45:34.684Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112514","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112514","modified":"Oct 28, 2026, 9:49:16 PM","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","checkedAt":"2026-10-28T22:45:34.888Z"}],"aiSummary":{"text":"AVideo-Encoder versions prior to 8.1.0 lack authentication on control and status endpoints, allowing unauthenticated attackers to access queue and streamer information, memory statistics, and media file names and paths. The weakness is due to missing authentication for critical functions and missing authorization. This affects AVideo-Encoder versions less than 8.1.0.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:45:46.196Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-61571"}]}}