CVE-2026-92582 AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
Attackers can trick authenticated users into modifying video records and bypassing access controls via CSRF due to disabled security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-92582?
CVE-2026-92582 is a high-severity vulnerability in WWBN AVideo, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely because 'user' and 'pass' parameters are present in the request; the values are never validated and are read from $_REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records — including ownership transfer (setUsers_id), deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory.
Weakness: CWE-352
Which versions are affected by CVE-2026-92582?
How do I fix CVE-2026-92582?
No fix has been published for CVE-2026-92582 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92582 being exploited?
There is no known exploitation of CVE-2026-92582 in the wild and no public exploit code.
Sources
Also known as GHSA-qf9p-jhx7-rhmf, GHSA-x968-qj2r-r49p.