WWBN AVideo CVE-2026-89243

Requires an authenticated AVideo administrator account that holds the canAdminUserGroups permission to write the malicious group_name (PR:H). Payload execution is not automatic - it depends on a second administrator subsequently browsing the user manager interface where the stored value is rendered (UI:P). Exploitation is therefore limited to environments with multiple admins and requires trust already granted to the injecting account; it is not remotely reachable by an unauthenticated or low-privileged user.

The CVSS 4.0 score of 9.2 (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N) appears overstated for what is a privileged-to-privileged stored XSS. Exploitation requires an authenticated administrator (PR:H) who already holds the canAdminUserGroups permission to plant the payload, and it fires only when another administrator interacts with the user manager (UI:P). The high VC/VI and scope-change (SC:H/SI:H) values assume the victim admin's session can be fully hijacked to pivot to broader system compromise, which is plausible but conditional. There is no EPSS-notable signal provided, no KEV listing, and no known POC - real-world risk is moderate and gated behind trusted-admin access, so this is best treated as a defense-in-depth/insider or account-compromise concern rather than an internet-facing critical.

A malicious or compromised administrator with the canAdminUserGroups permission creates or edits a user group, setting the group name to a string containing a JavaScript payload. When a higher-privileged administrator later opens the user manager to review groups, the script runs in their session, allowing the attacker to perform actions as that admin (e.g., create accounts, exfiltrate session data, or escalate privileges via same-origin requests). No public POC is identified at this time.