WWBN AVideo CVE-2026-58002

Exploitation requires a valid authenticated session on the target AVideo instance - a low-privilege user account is sufficient, with no administrator or moderator role needed (CVSS PR:L). The vulnerable endpoints Users_affiliations add.json.php and videoAddNew.json.php must be reachable over the network. The affiliation feature must be present in the running codebase, which it is by default in versions through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 - no non-default configuration is required to expose the flaw. Exploitation is limited to integrity impact within the AVideo application: video ownership records can be manipulated, but the flaw does not provide file system access, remote code execution, or privilege escalation to OS level. User interaction from the victim is not required.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) yields a score of 7.1 and accurately characterizes the attack surface: the vulnerable endpoints are network-reachable, exploitation is low-complexity, and only a low-privilege authenticated account is required. Real-world impact is bounded by the application's function - video ownership manipulation is a meaningful integrity violation within AVideo but carries no confidentiality or availability component, and does not provide code execution or OS-level access. EPSS data was not provided in the source intelligence, so quantitative exploitation probability cannot be anchored; the absence of a KEV listing and POC code modestly reduces urgency relative to the raw score. That said, the minimal privilege barrier and straightforward parameter-manipulation technique mean any registered user on a vulnerable instance can exploit this without specialized tooling. The CVSS vector's integrity-only impact profile is consistent with the description - no conflicting signals were identified.

An authenticated low-privilege user sends a crafted POST request to Users_affiliations add.json.php, supplying the target content owner's user ID as the counterparty and fabricating a plausible current timestamp for that party's consent. The server records the affiliation with status='a' without contacting or verifying the second party. The attacker then calls videoAddNew.json.php referencing the forged affiliation ID, which the endpoint accepts as a valid authorization term, reassigning ownership of the victim's videos to the attacker's account or to any arbitrary user on the platform.