An unauthenticated information disclosure vulnerability in AVideo Platform 8.1 allows unauthorized actors to harvest sensitive user credentials and administrative metadata.

The application fails to perform adequate authorization checks on the playlistsFromUser.json.php endpoint. By manipulating the users_id parameter, an unauthenticated attacker can force the application to return sensitive data, including email addresses, password hashes, and administrative status.

The exposure of user password hashes and administrative status poses a severe risk to organizational security. Successful exploitation enables attackers to perform credential stuffing or brute-force attacks against administrative accounts, potentially leading to a full system compromise. Given the CVSS score of 7.5, this high-severity flaw represents a significant threat to data confidentiality and platform integrity.

Immediate Action: Upgrade to a secure, supported version of the AVideo Platform immediately, as version 8.1 is confirmed to be vulnerable.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting the playlistsFromUser.json.php endpoint, specifically those containing sequential or suspicious numeric values in the users_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or restrict access to the /objects/playlistsFromUser.json.php endpoint from untrusted external networks.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in ExploitDB (EDB-ID 47997).

This vulnerability presents a clear and present danger to the confidentiality of your user base. Because the exploit mechanism is publicly documented and requires no authentication, the window for remediation is narrow. It is critical that administrators identify all instances of AVideo Platform 8.1 within their environment and apply the necessary patches or updates to prevent unauthorized data exfiltration.