Insecure Direct Object Reference in AVideo by WWBN
CVE-2026-89257

5.3MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
11 September 2026

What is CVE-2026-89257?

AVideo versions up to 29.0 exhibit an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated non-admin users to exploit improper validation in the category asset deletion process. Specifically, through the endpoint objects/categoryDeleteAssets.json.php, users can bypass essential ownership checks by exploiting the Category::canCreateCategory() capability and a CSRF nonce, enabling them to send POST requests with arbitrary category IDs. This vulnerability could lead to the unauthorized deletion of category asset directories from the server, affecting the integrity of the media assets while leaving category records intact. As of the issuance of this advisory, there are currently no patched versions available.

Affected Version(s)

AVideo 0 <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-g...
vendor-advisory
https://www.vulncheck.com/advisories/avideo-through-29.0-...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.