GHSA-j36m-74g2-7m95 AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

• Packagist wwbn/avideo: <= 26.0 (no fix yet)

Summary The `plugin/AD_Server/reports.json.php` endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (`reports.php`) and CSV export (`getCSV.php`) both correctly enforce `User::isAdmin()`, but the JSON API was left unprotected. Details The vulnerable file `plugin/AD_Server/reports.json.php` loads the application configuration at line 5 but never checks whether the request comes from an authenticated admin user: ```php // plugin/AD_Server/reports.json.php:1-10 'You must be an admin to access this resource'])); } ``` plugin/AD_Server/getData.json.php — add after line 4: ```php header('Content-Type: application/json'); require_once '../../videos/configuration.php'; if (!User::isAdmin()) { header('HTTP/1.1 403 Forbidden'); die(json_encode(['error' => true, 'msg' => 'You must be an admin to access this resource'])); } ```