CVE-2026-34738

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

• CWE-285

• https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7jExploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7jExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34732WWBN AVideo is an open source video platform. In versions 26…7.5
• CVE-2026-34733WWBN AVideo is an open source video platform. In versions 26…7.3
• CVE-2026-34734HDF5 is software for managing data. In 1.14.1-2 and earlier,…7.8
• CVE-2026-34735The Hytale Modding Wiki is a free service for Hytale mods to…8.7
• CVE-2026-34736Open edX Platform enables the authoring and delivery of onli…5.3
• CVE-2026-34737WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34739WWBN AVideo is an open source video platform. In versions 26…6.1
• CVE-2026-3474The EmailKit – Email Customizer for WooCommerce & WP plugin …4.9
• CVE-2026-34740WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34742The Go MCP SDK used Go's standard encoding/json. Prior to ve…8.1
• CVE-2026-34743XZ Utils provide a general-purpose data-compression library …5.3
• CVE-2026-34744Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3