CVE-2026-33649

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access. As of time of publication, no known patched versions are available.

• CWE-352

• https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvjExploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvjExploit, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33643SQL Injection vulnerability in SchemaHero 0.23.0 via the col…7.4
• CVE-2026-33644Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-33645Fireshare facilitates self-hosted media and link sharing. In…8.1
• CVE-2026-33646mise manages dev tools like node, python, cmake, and terrafo…9.6
• CVE-2026-33647WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33648WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33650WWBN AVideo is an open source video platform. In versions up…7.6
• CVE-2026-33651WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33653Ulloady is a file uploader script with multi-file upload sup…5.4
• CVE-2026-33654nanobot is a personal AI assistant. Prior to version 0.1.6, …9.8
• CVE-2026-33655New API is a large language mode (LLM) gateway and artificia…7.7
• CVE-2026-33656EspoCRM is an open source customer relationship management a…9.1