EUVD-2026-17656
GHSA-m577-w9j8-ch7j
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score is 4.3 (Low), the real-world risk is contextual and potentially significant for content-moderated platforms. The attack vector is network-based, requires low complexity, and requires low privileges (authenticated uploader only-not admin), making exploitation straightforward. However, EPSS exploitation probability is not provided in the input data. The vulnerability has no confirmed active exploitation (no KEV status), and no public proof-of-concept code exists, reducing immediate attack likelihood. Under SSVC frameworks, exploitation is unconfirmed but likely feasible (low complexity), the technical impact is moderate (integrity of content moderation bypass), and automatable by any authenticated uploader. For organizations relying on AVideo for user-generated content platforms, this represents a meaningful integrity risk; for smaller deployments or those with manual override controls, risk is lower. |
| Exploit ScenarioDerived | An authenticated uploader logs into an AVideo instance, uploads a video (which is placed in draft state by default pending moderation), and crafts an HTTP request with the overrideStatus=a parameter to directly transition the video to active status, bypassing the admin review queue. The video immediately becomes publicly visible without passing content moderation checks. No special tools or exploit code are required; the attack requires only HTTP request manipulation and valid user credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
WWBN AVideo versions 26.0 and prior allow authenticated uploaders to bypass content moderation by directly setting video status to active via an unvalidated overrideStatus parameter, circumventing admin-controlled review workflows. The vulnerability affects any user with upload permissions and has a CVSS score of 4.3 (low-to-moderate severity) with no public exploit code identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Immediate mitigation options include: (1) restrict upload permissions to trusted users only until a patch is available; (2) implement server-side authorization checks in the setStatus() method to verify that only admins or designated moderators can change video status, particularly to 'active' state; (3) audit existing videos marked as 'active' to identify any that bypassed moderation; (4) monitor video status change logs for unauthorized transitions. Contact WWBN or monitor the GitHub Security Advisory (https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j) for patch availability and timeline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AVideo's video processing pipeline implements a setStatus() method that validates incoming status codes against a whitelist of permitted states (including 'active') but fails to perform authorization checks to ensure the caller has permission to transition a video to that state. This is a classic authorization bypass flaw (CWE-285: Improper Authorization) where business logic validation exists but privilege validation is absent. The vulnerability leverages the HTTP request parameter overrideStatus to inject status transitions directly into the video object lifecycle, bypassing the intended moderation and draft workflow states that admins control.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB