CVE-2026-33649 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access. As of time of publication, no known patched versions are available.
A vulnerability in WWBN AVideo versions through 26.0 allows for privilege escalation through cross-site request forgery (CSRF) via the 'plugin/Permissions/setPermission.json.php' endpoint. This endpoint accepts GET parameters to modify user group permissions but lacks CSRF token validation. Additionally, the application sets session cookies to 'SameSite=None', enabling an unauthenticated attacker to create a page that, when visited by an admin, silently alters permissions for the attacker's user group, effectively granting near-admin access. As of the publication date, no patched versions are available.
To address this vulnerability, the 'plugin/Permissions/setPermission.json.php' file should be modified to accept POST requests instead of GET requests and to include CSRF token validation. The AJAX call in 'getPermissionsFromPlugin.html.php' should also be updated to send the 'globalToken' parameter with the data payload.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | New CVE Received | [email protected] |