CVE-2026-33650 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" permission can escalate privileges to perform full video management operations — including ownership transfer and deletion of any video — despite the permission being documented as only allowing video publicity changes (Active, Inactive, Unlisted). The root cause is that `Permissions::canModerateVideos()` is used as an authorization gate for full video editing in `videoAddNew.json.php`, while `videoDelete.json.php` only checks ownership, creating an asymmetric authorization boundary exploitable via a two-step ownership-transfer-then-delete chain. Commit 838e16818c793779406ecbf34ebaeba9830e33f8 contains a patch.
A privilege escalation vulnerability has been identified in WWBN AVideo versions through 26.0. A user with 'Videos Moderator' permissions can gain unauthorized access to full video management capabilities, including transferring ownership and deleting any video. This exploitation arises because the permission check for moderating videos is improperly applied, allowing moderators to bypass intended restrictions. The vulnerability creates an asymmetric authorization flaw that can be exploited by first transferring video ownership and then deleting the video.
Users are advised to update to version 27.0 or later, where this vulnerability has been addressed. In the patched version, the authorization checks have been corrected to ensure that 'Videos Moderator' permissions do not grant full editing rights or ownership transfer capabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-8x77-f38v-4m5j | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/commit/838e16818c793779406ecbf34ebaeba9830e33f8 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-8x77-f38v-4m5j | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | New CVE Received | [email protected] |