CVE-2026-33650: Wwbn Avideo Privilege Escalation Flaw

CVE-2026-33650 Overview

WWBN AVideo, an open source video platform, contains a privilege escalation vulnerability in versions up to and including 26.0. A user with the "Videos Moderator" permission can escalate privileges to perform full video management operations — including ownership transfer and deletion of any video — despite the permission being documented as only allowing video publicity changes (Active, Inactive, Unlisted). This broken access control vulnerability (CWE-863) enables attackers with limited moderator access to gain unauthorized control over video assets across the platform.

Critical Impact

Authenticated users with limited moderator privileges can transfer ownership and delete any video on the platform through a two-step exploitation chain, bypassing intended authorization controls.

Affected Products

• WWBN AVideo versions up to and including 26.0
• All AVideo installations using the Videos Moderator permission model
• Self-hosted AVideo deployments with default permission configurations

Discovery Timeline

• 2026-03-23 - CVE-2026-33650 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33650

Vulnerability Analysis

This vulnerability represents a classic broken access control flaw where the authorization mechanism uses inconsistent permission checks across related operations. The root issue lies in the asymmetric authorization boundary between video editing and video deletion functions. While videoAddNew.json.php uses Permissions::canModerateVideos() as an authorization gate for full video editing capabilities (including ownership transfer), the videoDelete.json.php endpoint only verifies ownership without validating moderator-level restrictions. This architectural inconsistency allows an attacker to chain two operations together: first transferring ownership of a target video to themselves (permitted by the overly permissive moderator check), then deleting the video (now permitted because they are the owner).

Root Cause

The root cause is an inconsistent implementation of authorization checks between the Permissions::canModerateVideos() function and the ownership-only verification in the delete endpoint. The moderator permission was designed to control video publicity states (Active, Inactive, Unlisted), but the same permission check is incorrectly reused to authorize full video editing operations including ownership transfer. This design flaw creates an exploitable gap where a moderator can exceed their documented privilege level.

Attack Vector

The attack exploits the network-accessible API endpoints with a two-step chain that requires only low-privilege authenticated access:

1. An attacker authenticates as a user with the "Videos Moderator" permission
2. The attacker sends a request to videoAddNew.json.php to transfer ownership of a target video to their own account (authorized by the overly permissive canModerateVideos() check)
3. Now as the "owner" of the video, the attacker sends a delete request to videoDelete.json.php (authorized by the ownership check)
4. The target video is permanently deleted, despite the attacker never having legitimate ownership or deletion rights

The vulnerability requires low privileges (authenticated moderator account) and no user interaction, making it exploitable through automated requests against the application's JSON API endpoints.

Detection Methods for CVE-2026-33650

Indicators of Compromise

• Unexpected video ownership changes in application logs, particularly videos transferred to moderator accounts
• Mass video deletions by users who recently received ownership via transfer
• API requests to videoAddNew.json.php and videoDelete.json.php from the same session in quick succession
• Moderator accounts making ownership transfer requests outside of normal administrative workflows

Detection Strategies

• Monitor API access logs for patterns showing ownership transfer immediately followed by deletion from the same user
• Implement anomaly detection for moderator accounts performing ownership transfers, which should not be a normal moderator operation
• Review audit trails for users with Videos Moderator permission executing operations beyond publicity changes
• Alert on high-volume video deletion activity from accounts that recently received transferred ownership

Monitoring Recommendations

• Enable detailed logging for all videoAddNew.json.php and videoDelete.json.php API endpoints
• Create alerts for ownership transfer events, particularly when initiated by moderator-level accounts
• Implement rate limiting on video management API endpoints to slow potential exploitation
• Establish baseline metrics for normal moderator activity to detect anomalous privilege usage

How to Mitigate CVE-2026-33650

Immediate Actions Required

• Upgrade WWBN AVideo to a version containing commit 838e16818c793779406ecbf34ebaeba9830e33f8 or later
• Audit current Videos Moderator permission assignments and limit to trusted personnel only
• Review video ownership change logs for any suspicious activity that may indicate prior exploitation
• Consider temporarily revoking Videos Moderator permissions until the patch is applied

Patch Information

WWBN has released a fix in commit 838e16818c793779406ecbf34ebaeba9830e33f8. The patch addresses the asymmetric authorization boundary by implementing proper permission checks that prevent moderators from performing operations beyond their documented scope. Administrators should apply this patch immediately by updating to the latest version of AVideo. For detailed technical information about the vulnerability and remediation, refer to the GitHub Security Advisory and the commit details.

Workarounds

• Disable or restrict the Videos Moderator permission entirely until the patch can be applied
• Implement network-level access controls to limit API endpoint access to trusted IP ranges
• Deploy a web application firewall (WAF) rule to block ownership transfer requests from moderator-level accounts
• Enable enhanced logging and monitoring on the affected endpoints to detect exploitation attempts