CVE-2026-58002 WWBN AVideo Authorization Bypass via Users_affiliations add.json.php
Authenticated attackers can forge affiliation records to bypass authorization checks and reassign video ownership to arbitrary users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58002?
CVE-2026-58002 is a high-severity missing authorization vulnerability in WWBN AVideo, published on 22 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in the Users_affiliations add.json.php endpoint that allows authenticated users to forge two-party consent records by supplying the counterparty's agreement timestamp. Attackers can create a forged affiliation with status='a' and then reassign video ownership to arbitrary users through the videoAddNew.json.php endpoint, which trusts the forged affiliation as an authorization term.
Weakness: CWE-345
Which versions are affected by CVE-2026-58002?
How do I fix CVE-2026-58002?
No fix has been published for CVE-2026-58002 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-58002 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58002 exists.
Sources
Also known as GHSA-rg7g-cgjq-4wx8, GHSA-v8xr-qf65-qqxj.