Avideo CVE-2026-33649

WWBN AVideo versions ≤26.0 with default session.cookie_samesite=None configuration. Requires admin victim to visit attacker-controlled webpage containing crafted <img> tags. No CSRF token validation on plugin/Permissions/setPermission.json.php GET endpoint enables silent permission escalation.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates a network-exploitable vulnerability with low attack complexity requiring no privileges, though user interaction (admin visiting malicious page) is required. The High confidentiality and integrity impact reflects the privilege escalation outcome. Real-world risk is elevated because CSRF vulnerabilities are straightforward to exploit with basic HTML knowledge, the attack requires only social engineering to get an admin to visit a page, and the platform's SameSite=None configuration removes default browser protections. The absence of a patch as of publication significantly increases risk for current deployments. While no EPSS score or KEV listing is provided in the intelligence, the technical simplicity combined with high impact and zero-day status makes this a genuine priority for AVideo installations, particularly those with multiple user tiers or untrusted users who could craft attacks targeting administrators.

An attacker with a low-privilege user account on an AVideo instance creates a malicious web page containing hidden image tags with src attributes pointing to the vulnerable setPermission.json.php endpoint with crafted parameters to grant full permissions to the attacker's user group. The attacker then uses social engineering (such as sharing the link in platform messages, forums, or email) to trick an authenticated administrator into visiting the page. When the admin loads the page, their browser automatically sends the GET requests with admin session cookies due to the SameSite=None setting, silently granting the attacker's group near-admin privileges without any visible interaction or warning, enabling the attacker to subsequently access sensitive video content, modify platform settings, or compromise other users.