CVE-2026-114633 Details

A vulnerability exists in WWBN AVideo versions prior to 29.4.0, allowing users with delegated 'Users Admin' permissions to improperly delete or modify administrator accounts. Exploitation involves sending requests to 'confirmDeleteUser.json.php' or 'userAddNew.json.php' that target admin accounts, leading to the deletion of their videos and accounts or unauthorized changes and demotions. The issue arises because the application fails to properly validate authorization when managing admin accounts, particularly through the user deletion and account editing endpoints.

Update to AVideo version 29.4.0 or later. The patch requires implementing proper admin checks in the user deletion and editing endpoints and using a mutation lock to prevent concurrent modification issues. If an update is not possible, revoke 'Users Admin' permissions from accounts that should not have control over admin accounts.