CVE-2026-33501: 
PHP vulnerability analysis and mitigation

CVE-2026-33501 is an unauthenticated information disclosure vulnerability in WWBN AVideo, an open-source video platform. The flaw allows any unauthenticated attacker to retrieve the complete permission matrix mapping user groups to plugins via an unprotected endpoint. It affects AVideo versions up to and including 26.0. The vulnerability was published on March 20, 2026, with patches committed to the repository shortly after. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory GHSA-96qp-8cmq-jvq8).

The root cause is a missing authorization check (CWE-862) on the endpoint plugin/Permissions/View/Users_groups_permissions/list.json.php. This file calls ObjectYPT::getAll(), which executes a raw SELECT * FROM users_groups_permissions WHERE 1=1 query and returns all rows as JSON with no access control. All sibling endpoints in the same directory (add.json.php, delete.json.php, index.php) correctly enforce User::isAdmin(), making this an isolated oversight. Additionally, the getSqlFromPost() method processes $_POST['sort'] and $_GET parameters, allowing an attacker to paginate and sort results to systematically extract all data. No authentication, network restrictions, or .htaccess rules protect the endpoint (GitHub Advisory GHSA-96qp-8cmq-jvq8).

Successful exploitation allows an unauthenticated remote attacker to enumerate the complete authorization architecture of an AVideo instance, including all user group IDs and their associated plugin access, all installed plugin IDs and permission configurations, and the active/inactive status of each group-plugin permission pair. While the vulnerability does not directly enable data modification or code execution, it provides a detailed roadmap that significantly reduces attacker effort for follow-up privilege escalation attacks by revealing exactly which groups have access to which plugins and at what permission levels (GitHub Advisory GHSA-96qp-8cmq-jvq8, Feedly).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a simple curl command requiring no authentication or special tooling. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.149%, reflecting low but non-zero exploitation probability (GitHub Advisory GHSA-96qp-8cmq-jvq8, Feedly).

1. Reconnaissance: Identify internet-facing AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to the AVideo web interface.
2. Send unauthenticated request: Issue a simple HTTP GET request to the vulnerable endpoint without any credentials:

curl -s https://target/plugin/Permissions/View/Users_groups_permissions/list.json.php

3. Parse the response: The server returns a JSON object containing all rows from the users_groups_permissions table, including users_groups_id, plugins_id, type (permission level), and status (active/inactive).
4. Paginate and sort for complete extraction: Use $_GET or $_POST['sort'] parameters supported by getSqlFromPost() to paginate through all records and extract the full permission matrix systematically.
5. Map authorization architecture: Analyze the extracted data to identify which user groups have access to privileged plugins, then use this intelligence to target specific privilege escalation vectors in follow-up attacks (GitHub Advisory GHSA-96qp-8cmq-jvq8).

• Network: Unauthenticated HTTP GET requests to /plugin/Permissions/View/Users_groups_permissions/list.json.php from external or unexpected IP addresses; repeated requests with varying sort or pagination parameters to the same endpoint.
• Logs: Web server access logs showing 200 OK responses to list.json.php from unauthenticated sessions (no session cookie or auth header present); high-frequency requests to the endpoint from a single source IP.
• File System: No file-system artifacts are expected from read-only exploitation of this endpoint.

The recommended fix is to add the same User::isAdmin() authorization check used by sibling endpoints at the top of plugin/Permissions/View/Users_groups_permissions/list.json.php. Patches are available via GitHub commits b583acdc9a9d1eab461543caa363e1a104fb4516 and dc3c825734628bb32550d0daa125f05bacb6829c. As an interim workaround, administrators can restrict direct web access to the plugin/Permissions/View/Users_groups_permissions/ directory via .htaccess or web server configuration rules until the patch is applied (GitHub Advisory GHSA-96qp-8cmq-jvq8).