CVE-2026-114633: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-114633 Overview

CVE-2026-114633 is an incorrect authorization vulnerability [CWE-863] in WWBN AVideo versions before 29.4.0. Delegated Users Admin accounts can delete or modify administrator accounts through the confirmDeleteUser.json.php and userAddNew.json.php endpoints. Attackers with Users Admin privileges can target administrators to delete their videos and accounts, change their credentials, or demote them to lower-privileged roles. The flaw stems from missing authorization checks that fail to distinguish between standard users and administrators during account mutation operations.

Critical Impact

Delegated Users Admin accounts can hijack, demote, or delete administrator accounts, resulting in full compromise of platform governance and loss of administrative control over the AVideo instance.

Affected Products

• WWBN AVideo versions prior to 29.4.0
• AVideo confirmDeleteUser.json.php endpoint
• AVideo userAddNew.json.php endpoint

Discovery Timeline

• 2026-10-22 - CVE CVE-2026-114633 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114633

Vulnerability Analysis

The vulnerability resides in AVideo's user administration workflow. The application exposes confirmDeleteUser.json.php and userAddNew.json.php to accounts that hold the Users Admin delegated role. These endpoints perform account deletion and modification without verifying that the target user is not an administrator. A Users Admin account can therefore submit crafted requests to remove administrator accounts, demote them to standard users, or change their credentials.

Successful exploitation allows an attacker holding delegated Users Admin privileges to destroy videos owned by administrators, lock legitimate administrators out of the platform, or escalate their own control by stripping administrative roles. The impact extends to integrity and availability of the user base and the administrative control plane.

Root Cause

The root cause is a missing privilege-tier check in the user mutation code paths. The application treats the Users Admin role as sufficient authorization for operating on any user record, including those with administrator status. There is also no serialization of concurrent promotion and deletion operations, which the patch addresses with a named database lock.

Attack Vector

Exploitation requires network access to the AVideo application and authentication as a delegated Users Admin account. The attacker submits HTTP POST requests to the vulnerable JSON endpoints with a target users_id corresponding to an administrator. No user interaction is required from the victim.

// Patch excerpt: objects/UserAccountMutationLock.php
<?php

// Account promotion and deletion must share a lock, including while video hooks run.
// Named locks survive commits made by plugins; a surrounding transaction would not.
class UserAccountMutationLock
{
    private static $held = [];
    private $name;
    private $isAdmin;

    private function __construct($name)
    {
        $this->name = $name;
    }

    public static function acquire($users_id)
    {
        global $mysqlDatabase;
        $users_id = intval($users_id);
        if ($users_id <= 0) {
            return false;
        }
        $name = 'avideo_user_' . sha1($mysqlDatabase) . '_' . $users_id;
        if (isset(self::$held[$name])) {
            self::$held[$name]++;
            $lock = new self($name);
        } else {
            try {
                $res = sqlDAL::readSql('SELECT GET_LOCK(?, ?) AS locked', 'si', [$name, 10], true);
                if ($res === false) {

Source: WWBN AVideo commit 9c7cadae

Detection Methods for CVE-2026-114633

Indicators of Compromise

• POST requests from Users Admin accounts to confirmDeleteUser.json.php or userAddNew.json.php where the users_id parameter targets a known administrator account.
• Unexpected deletions or role changes on administrator accounts recorded in the AVideo users table.
• Mass deletion of videos owned by administrator-owned channels within a short time window.

Detection Strategies

• Audit web server access logs for calls to confirmDeleteUser.json.php and userAddNew.json.php and correlate the authenticated session against the privilege level of the targeted users_id.
• Enable database audit logging on the users table to capture UPDATE and DELETE statements affecting rows where is_admin = 1.
• Baseline normal Users Admin activity volume and alert on deviations such as repeated modification attempts against privileged accounts.

Monitoring Recommendations

• Forward AVideo application and web server logs to a centralized analytics platform for retention and correlation.
• Monitor administrator account inventory changes and generate alerts when admin counts decrease or admin password hashes change outside expected maintenance windows.
• Review the GitHub Security Advisory GHSA-mp89-8x4j-2grx for additional detection context.

How to Mitigate CVE-2026-114633

Immediate Actions Required

• Upgrade WWBN AVideo to version 29.4.0 or later, which introduces the UserAccountMutationLock and enforces authorization on administrator-targeting operations.
• Review all accounts holding the delegated Users Admin role and revoke privileges that are not operationally required.
• Audit the users table for unauthorized role changes, deletions, or credential modifications affecting administrator accounts.

Patch Information

The fix is implemented in commit 9c7cadae and ships in AVideo 29.4.0. The patch adds objects/UserAccountMutationLock.php, which acquires a MySQL named lock (GET_LOCK) around promotion and deletion operations so that account mutation cannot race across requests or plugin hooks. Refer to the VulnCheck advisory for additional details.

Workarounds

• Restrict the Users Admin role to trusted operators only and remove the role from accounts that do not require it until the upgrade is applied.
• Place the AVideo administrative paths behind a reverse proxy with IP allowlisting so that confirmDeleteUser.json.php and userAddNew.json.php are reachable only from administrative networks.
• Enforce multi-factor authentication on all delegated administrative accounts to reduce the risk of credential theft leading to exploitation.

# Example: block user mutation endpoints from untrusted sources via Nginx
location ~ ^/(confirmDeleteUser|userAddNew)\.json\.php$ {
    allow 10.0.0.0/8;        # trusted admin network
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}