CVE-2026-33684

CVE-2026-33684 · AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows any user who can solve a CAPTCHA to self-grant elevated permissions during account registration. The set_api_signUp method in the API plugin accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input and applies them to newly created accounts without verifying that the request was authenticated with a valid APISecret. By self-granting account attributes, attackers can mark their own accounts as email-verified without owning the address (bypassing email-gated functionality) and award themselves upload, streaming, and meeting-creation permissions, circumventing administrator access controls that intentionally restrict these capabilities for new users. This issue has been fixed in version 29.0

CVSS 5.3 · Moyenne · EPSS 0,2% · Correctif disponible

Publication

2026-07-15T20:47:45.146Z

Mise à jour

2026-07-16T12:54:14.283Z

Pile logicielle: php

Vérifiez votre serveur →