CVE-2026-33501

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any authentication or authorization check, allowing unauthenticated users to retrieve the complete permission matrix mapping user groups to plugins. All sibling endpoints in the same directory (`add.json.php`, `delete.json.php`, `index.php`) properly require `User::isAdmin()`, indicating this is an oversight. Commits dc3c825734628bb32550d0daa125f05bacb6829c and b583acdc9a9d1eab461543caa363e1a104fb4516 contain patches.

• CWE-862

• https://github.com/WWBN/AVideo/commit/b583acdc9a9d1eab461543caa363e1a104fb4516Patch
• https://github.com/WWBN/AVideo/commit/dc3c825734628bb32550d0daa125f05bacb6829cPatch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-96qp-8cmq-jvq8Exploit, Mitigation, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33496ORY Oathkeeper is an Identity & Access Proxy (IAP) and Acces…8.1
• CVE-2026-33497Langflow is a tool for building and deploying AI-powered age…7.5
• CVE-2026-33498Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-33499WWBN AVideo is an open source video platform. In versions up…6.1
• CVE-2026-3350The Image Alt Text Manager plugin for WordPress is vulnerabl…6.4
• CVE-2026-33500WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-33502WWBN AVideo is an open source video platform. In versions up…8.2
• CVE-2026-33503Ory Kratos is an identity, user management and authenticatio…7.2
• CVE-2026-33504Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider…7.2
• CVE-2026-33505Ory Keto is am open source authorization server for managing…7.2
• CVE-2026-33506Ory Polis, formerly known as BoxyHQ Jackson, bridges or prox…8.8
• CVE-2026-33507WWBN AVideo is an open source video platform. In versions up…8.8