What is the CVSS score of CVE-2026-33650?

CVE-2026-33650 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33650?

A privilege escalation vulnerability in WWBN AVideo versions up to 26.0 allows video moderators to illegally escalate permissions and gain full control over all videos, including transferring…

How to fix or mitigate CVE-2026-33650?

Within 24 hours: Identify all AVideo instances running version 26.0 or earlier and restrict 'Videos Moderator' role assignments to highly trusted personnel only; audit current moderator accounts for suspicious activity. Within 7 days: Contact WWBN for patch availability status and subscribe to security advisories; implement network segmentation to limit moderator account access if patch remains unavailable. Within 30 days: Apply the vendor patch (commit 838e16818c793779406ecbf34ebaeba9830e33f8) to all AVideo instances and conduct access reviews to eliminate unnecessary moderator permissions.

PHP CVE-2026-33650

EUVD-2026-14488 HIGH

Incorrect Authorization (CWE-863)

2026-03-23 GitHub_M

GHSA-8x77-f38v-4m5j

PHP Authentication Bypass

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:45 euvd

EUVD-2026-14488

Analysis Generated

Mar 23, 2026 - 18:45 vuln.today

CVE Published

Mar 23, 2026 - 18:28 nvd

HIGH 7.6

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" permission can escalate privileges to perform full video management operations - including ownership transfer and deletion of any video - despite the permission being documented as only allowing video publicity changes (Active, Inactive, Unlisted). The root cause is that Permissions::canModerateVideos() is used as an authorization gate for full video editing in videoAddNew.json.php, while videoDelete.json.php only checks ownership, creating an asymmetric authorization boundary exploitable via a two-step ownership-transfer-then-delete chain. Commit 838e16818c793779406ecbf34ebaeba9830e33f8 contains a patch.

AnalysisAI

Privilege escalation in WWBN AVideo up to version 26.0 allows users with "Videos Moderator" permissions to gain full video management capabilities, including transferring ownership and deleting any video, by exploiting inconsistent authorization checks between the video editing and deletion endpoints. An authenticated attacker can chain an ownership transfer with deletion operations to compromise videos outside their legitimate scope. A patch is available in commit 838e16818c793779406ecbf34ebaeba9830e33f8.

Technical ContextAI

WWBN AVideo is an open-source PHP-based video platform (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The vulnerability represents a classic instance of CWE-863 (Incorrect Authorization), where the application implements inconsistent authorization boundaries across related operations. The Permissions::canModerateVideos() function is incorrectly used as an authorization gate in videoAddNew.json.php for full video editing capabilities, while videoDelete.json.php implements a separate ownership-based check. This creates an exploitable asymmetry where a moderator can transfer video ownership to themselves via the editing endpoint, then delete the video using the deletion endpoint that only validates current ownership without rechecking original permissions.

RemediationAI

Apply the patch provided in commit 838e16818c793779406ecbf34ebaeba9830e33f8 available at https://github.com/WWBN/AVideo/commit/838e16818c793779406ecbf34ebaeba9830e33f8, or upgrade to a version containing this fix. Review the GitHub Security Advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-8x77-f38v-4m5j for vendor-specific upgrade guidance and any additional security recommendations. As an interim mitigation until patching is complete, administrators should audit user accounts with Videos Moderator permissions, restrict this role to only fully trusted users, implement logging and monitoring of video ownership changes and deletions, and consider temporarily revoking the Videos Moderator permission if not operationally critical.