CVE-2026-33650

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" permission can escalate privileges to perform full video management operations — including ownership transfer and deletion of any video — despite the permission being documented as only allowing video publicity changes (Active, Inactive, Unlisted). The root cause is that `Permissions::canModerateVideos()` is used as an authorization gate for full video editing in `videoAddNew.json.php`, while `videoDelete.json.php` only checks ownership, creating an asymmetric authorization boundary exploitable via a two-step ownership-transfer-then-delete chain. Commit 838e16818c793779406ecbf34ebaeba9830e33f8 contains a patch.

• CWE-863

• https://github.com/WWBN/AVideo/commit/838e16818c793779406ecbf34ebaeba9830e33f8Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8x77-f38v-4m5jExploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8x77-f38v-4m5jExploit, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33644Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-33645Fireshare facilitates self-hosted media and link sharing. In…8.1
• CVE-2026-33646mise manages dev tools like node, python, cmake, and terrafo…9.6
• CVE-2026-33647WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33648WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33649WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33651WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33653Ulloady is a file uploader script with multi-file upload sup…5.4
• CVE-2026-33654nanobot is a personal AI assistant. Prior to version 0.1.6, …9.8
• CVE-2026-33655New API is a large language mode (LLM) gateway and artificia…7.7
• CVE-2026-33656EspoCRM is an open source customer relationship management a…9.1
• CVE-2026-33657EspoCRM is an open source customer relationship management a…5.4