What is the CVSS score of EUVD-2026-14496?

EUVD-2026-14496 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-14496?

Organizations using versions should be aware of moderate risk from CVE-2026-33685, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2026-14496?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP EUVD-2026-14496

| CVE-2026-33685 MEDIUM

Missing Authorization (CWE-862)

2026-03-23 GitHub_M

GHSA-j36m-74g2-7m95

Authentication Bypass PHP

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14496

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:42 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/AD_Server/reports.json.php endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (reports.php) and CSV export (getCSV.php) both correctly enforce User::isAdmin(), but the JSON API was left unprotected. Commit daca4ffb1ce19643eecaa044362c41ac2ce45dde contains a patch.

AnalysisAI

WWBN AVideo versions up to 26.0 expose advertising analytics data through an unauthenticated JSON API endpoint that lacks access controls, allowing attackers to retrieve sensitive information including video titles, user identifiers, channel names, and ad campaign performance metrics. While the HTML and CSV export functions properly enforce admin authentication, the JSON variant was left unprotected, enabling unauthorized data disclosure with no authentication required. A patch is available in commit daca4ffb1ce19643eecaa044362c41ac2ce45dde.

Technical ContextAI

WWBN AVideo is an open-source PHP-based video platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) that provides ad server reporting capabilities. The vulnerability stems from a missing authorization check in the PHP endpoint plugin/AD_Server/reports.json.php, which represents a classic instance of CWE-862 (Missing Authorization). Unlike its HTML counterpart (reports.php) and CSV export mechanism (getCSV.php), which both invoke User::isAdmin() to enforce role-based access control, the JSON API endpoint fails to perform this authentication gate. This inconsistency suggests the JSON endpoint was either added after the authorization pattern was established or overlooked during security review. The endpoint exposes data via JSON serialization without rate-limiting or session validation, making it trivial to enumerate analytics data programmatically.

RemediationAI

Immediately upgrade WWBN AVideo to a version containing commit daca4ffb1ce19643eecaa044362c41ac2ce45dde or later (consult the vendor's releases page to identify the first patched version after 26.0). If immediate patching is not feasible, implement network-level access controls to restrict access to the plugin/AD_Server/ directory to trusted administrative IP ranges only, and consider disabling the AD_Server plugin if not in active use. Additionally, review web server access logs for unauthorized requests to reports.json.php to identify whether the endpoint has been exploited. Once patched, verify that the User::isAdmin() check is enforced consistently across all three reporting endpoints (JSON, HTML, and CSV) to prevent similar inconsistencies in the future.