Avideo CVE-2026-33650

Attacker must have authenticated access with the 'Videos Moderator' permission in WWBN AVideo versions up to 26.0. No victim interaction required. Remote exploitation via videoAddNew.json.php and videoDelete.json.php endpoints.

The CVSS score of 7.6 (High) reflects network-based exploitation (AV:N) with low complexity (AC:L) requiring only low-level authenticated access (PR:L) and no user interaction (UI:N), producing high integrity impact (I:H) with low confidentiality and availability impacts. The vulnerability poses moderate real-world risk because it requires prior authentication with a specific moderator role, limiting the attack surface to insider threats or compromised moderator accounts. While the CVSS complexity is low and the attack chain is straightforward (transfer ownership then delete), exploitation requires legitimate platform access. No EPSS score, KEV listing, or public proof-of-concept is mentioned in the available data, suggesting limited in-the-wild exploitation. Organizations running AVideo with multiple user permission tiers should prioritize patching, while single-administrator deployments face lower risk.

An authenticated attacker with the Videos Moderator permission logs into the AVideo platform and identifies a target video owned by another user. The attacker exploits the overprivileged canModerateVideos() check by calling videoAddNew.json.php to transfer ownership of the victim's video to themselves, then immediately calls videoDelete.json.php which only validates current ownership, successfully deleting the video despite lacking legitimate authority. This attack requires only low-complexity HTTP requests to the vulnerable endpoints and can be executed without user interaction.