WWBN AVideo CVE-2026-40926

Exploitation requires that the victim be a currently authenticated AVideo administrator (an account passing Category::canCreateCategory() / User::isAdmin()) who is lured, while that session is active, into loading attacker-controlled web content that issues the cross-site request (UI:R). What limits exploitation: the attacker cannot self-exploit - no valid action occurs without an already-logged-in admin performing the interaction; impact is bounded to category create/overwrite/delete and invocation of installed plugins' updateScript() methods, with no direct data disclosure (C:N); and any deployment already enforcing strict SameSite cookies or origin checks at a proxy would block the forged request. The vulnerable code path exists in default configurations of versions <= 29.0, so no non-default feature toggle is required beyond having admin users and, for the plugin vector, installed plugins that implement updateScript().

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, 7.1 High) reflects a classic CSRF profile: network-reachable and low-complexity, but requiring victim interaction (UI:R) and, critically, that the victim already be an authenticated administrator. PR:N is scored because the attacker holds no credentials - the privilege belongs to the lured admin - which is standard for CSRF but should not be misread as fully unauthenticated impact. SSVC rates exploitation as poc, automatable as no, and technical impact as partial, aligning with the very low EPSS (0.02%, 5th percentile). There is no KEV listing and no evidence of active exploitation. Net: this is a legitimate High-severity integrity issue worth patching, but real-world urgency is tempered by the need to social-engineer a logged-in admin, the lack of confidentiality impact, and the non-automatable, non-mass-exploitable nature of the flaw. It is not a drop-everything, worm-class vulnerability.

An attacker crafts a web page with a hidden auto-submitting form (or fetch) that POSTs to /objects/pluginRunUpdateScript.json.php or /objects/categoryDelete.json.php on the target AVideo instance, then lures a currently logged-in administrator to visit it. Because the endpoints validate only the admin's session cookie and no CSRF token, the browser silently performs the state-changing action - deleting/overwriting categories or forcing a plugin's updateScript() to run - in the admin's context. Exploit code is reported to exist (SSVC: poc), and the low attack complexity means a single crafted request per action suffices once the admin loads the page.