CVE-2026-89257 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in AVideo versions through 29.0. The issue resides in the 'objects/categoryDeleteAssets.json.php' file, where the endpoint only validates the 'canCreateCategory()' capability and a CSRF nonce. It then passes the user-supplied category ID to the 'deleteAssets()' function, which recursively removes the corresponding asset directory. However, this process skips the crucial 'userCanEditCategory()' ownership check that is enforced by the related 'delete()' function. On installations with the 'usersCanCreateNewCategories' setting enabled, an authenticated non-admin user with upload privileges can exploit this vulnerability to delete any category's on-disk assets, such as icons and images. While category records and videos remain intact, the absence of a patched version as of the advisory publication date is notable.