Permission Escalation Vulnerability in WWBN AVideo Open Source Video Platform
CVE-2026-33649

8.1HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33649?

The WWBN AVideo platform is vulnerable due to its handling of permissions at the plugin/Permissions/setPermission.json.php endpoint. This vulnerability lets an attacker execute a state-changing operation that modifies user group permissions without the need for authentication. The absence of CSRF token validation alongside improper session cookie settings (session.cookie_samesite=None) opens the door for an attacker to manipulate sessions. By crafting a page with specifically designed <img> tags, an unauthenticated attacker can elevate their access to that of an admin when the crafted page is visited by an administrator. Currently, there are no known patches to mitigate this vulnerability.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-g...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.