WWBN AVideo CVE-2026-114633

Exploitation requires an authenticated 'Users Admin' delegated account (the Permissions::canAdminUsers() role) on a WWBN AVideo instance before version 29.4.0; the attacker must already possess or have compromised this specific delegated role. Given that access, the flaw is triggered simply by submitting POST requests to confirmDeleteUser.json.php or userAddNew.json.php with an administrator's user ID as the target - no additional configuration, user interaction, or admin-level privilege is needed. Limiting factors: it is NOT exploitable by anonymous/unauthenticated visitors or ordinary users (the delegated Users Admin role is a prerequisite), and only affects versions prior to 29.4.0; the UI already hides admin-row commands from non-admins, so exploitation requires crafting requests directly rather than using the normal interface.

This is a genuine but privilege-gated authorization flaw (CWE-863), not a high-CVSS-but-illusory issue, though its real-world urgency is moderate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H, score 7.0) is internally consistent with the description: network-reachable, low complexity, no user interaction, but requiring high privileges (PR:H) - specifically a delegated 'Users Admin' account. The impact is integrity and availability (VI:H/VA:H) with no confidentiality loss (VC:N), matching an attacker who can delete/demote admin accounts and their videos but not exfiltrate data. No EPSS score, KEV listing, or POC indicator was provided, so there is no public evidence of active or probable exploitation - the signals do not conflict, they are simply absent on the exploitation-likelihood side. The patch (commit 9c7cadaee8f) and vendor GHSA advisory are confirmed, and the fix logic independently corroborates the described attack surface (confirmDeleteUser/userAddNew/API delete paths now reject admin targets from non-admins). Net: a real insider/compromised-delegate privilege-boundary bug worth patching, but not a mass-exploitation emergency given the PR:H prerequisite and niche product footprint.

An attacker who holds (or compromises) a delegated 'Users Admin' account - a role intended only to manage ordinary users - sends a crafted request to confirmDeleteUser.json.php or userAddNew.json.php specifying an administrator's user ID. Because the pre-patch code never verifies the target is an admin, the attacker deletes the administrator's account and videos, or edits/demotes the admin to a normal user, breaking the privilege boundary. No public exploit identified at time of analysis, but the attack is simple HTTP POSTs with no user interaction required.