CVE-2026-114633

Overview

WWBN AVideo before 29.4.0 contains an incorrect authorization flaw that allows delegated Users Admin accounts to delete or modify administrator accounts. This can lead to loss of admin control and deletion of content, compromising the integrity and availability of the platform. The vulnerability affects installations running older AVideo versions.

Description

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

Impact

Confidentiality: potential exposure of admin credentials if accounts are deleted. Integrity: unauthorized modifications or deletions of administrator accounts and associated videos. Availability: removal of admin accounts can lock out legitimate users. Defenders such as system administrators and security teams are directly impacted.

Remediation

Apply the official patch to AVideo 29.4.0 or later. Review and tighten role assignments, ensuring delegated Users Admins do not have privileges to delete or modify administrator accounts. Audit access logs for suspicious activity and enforce principle of least privilege on all endpoints.

Risk context

The vulnerability is rated high with CVSS v3 score 6.5 and CVSS v4 score 7.0. No EPSS data is available. Defenders should prioritize patching and role review promptly to mitigate potential administrative lockout.

Affected products

• WWBN AVideo