CVE-2026-89257 Overview
CVE-2026-89257 is an insecure direct object reference (IDOR) vulnerability in AVideo through version 29.0. The flaw resides in objects/categoryDeleteAssets.json.php, which enforces only the Category::canCreateCategory() capability and a CSRF nonce before invoking Category::deleteAssets() with attacker-controlled input. The endpoint omits the Category::userCanEditCategory() ownership check present in the sibling Category::delete() method. On installations where usersCanCreateNewCategories is enabled, an authenticated user with the canUpload capability can recursively delete any category's on-disk asset directory. Category records and video content remain intact, but icons and images tied to arbitrary categories are destroyed.
Critical Impact
Authenticated non-admin users can recursively delete on-disk asset directories ({systemRootPath}videos/categories/assets/{id}/) for any category owned by any user, destroying icons and images across the installation.
Affected Products
- AVideo through version 29.0
- Installations with the non-default usersCanCreateNewCategories setting enabled
- Users with the canUpload capability on affected AVideo deployments
Discovery Timeline
- 2026-09-11 - CVE-2026-89257 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-89257
Vulnerability Analysis
The vulnerability [CWE-639] resides in objects/categoryDeleteAssets.json.php, an endpoint responsible for removing asset directories associated with categories in AVideo. The endpoint passes the raw $_REQUEST['id'] parameter to Category::deleteAssets() after only two checks: verifying the caller holds the canCreateCategory capability and validating a CSRF nonce. Both conditions are satisfiable by any authenticated uploader when usersCanCreateNewCategories is enabled. The sibling Category::delete() method enforces Category::userCanEditCategory() to confirm the caller owns the target category, but deleteAssets() does not.
Root Cause
The root cause is a missing authorization check on a state-changing operation. Category::deleteAssets() treats the supplied category ID as trusted and performs a recursive filesystem delete against {systemRootPath}videos/categories/assets/{id}/ without verifying that the authenticated user owns or has rights to modify that category. This is a textbook broken access control pattern where two functionally similar endpoints diverge in their authorization enforcement.
Attack Vector
An authenticated attacker with the canUpload capability crafts a POST request to categoryDeleteAssets.json.php, supplying a valid CSRF token and an arbitrary numeric id corresponding to another user's category. The server invokes the recursive delete against the target asset directory, removing icons and images belonging to the victim category. Because category records and video rows remain in the database, the impact surfaces as broken image links and missing branding assets rather than immediate data loss. See the GitHub Security Advisory for the underlying code paths.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-89257
Indicators of Compromise
- POST requests to /objects/categoryDeleteAssets.json.php originating from non-administrative user sessions
- Recursive deletion events under {systemRootPath}videos/categories/assets/ where the deleting web process is not correlated with an administrative action
- Missing icon or image files for categories whose owning user did not initiate a delete operation
- Application error logs referencing broken image paths under videos/categories/assets/{id}/
Detection Strategies
- Enable and review AVideo access logs for requests to categoryDeleteAssets.json.php and correlate the authenticated user with the target category owner.
- Deploy filesystem integrity monitoring on videos/categories/assets/ to alert on unexpected recursive deletions by the PHP-FPM or web server user.
- Baseline expected administrative delete activity and flag deviations where non-admin accounts trigger asset directory removals.
Monitoring Recommendations
- Forward web server and PHP application logs to a centralized log platform and alert on categoryDeleteAssets.json.php invocations.
- Track the usersCanCreateNewCategories configuration state and alert if it is enabled on production instances.
- Monitor for anomalous volumes of asset directory deletions within short time windows, which may indicate scripted abuse.
How to Mitigate CVE-2026-89257
Immediate Actions Required
- Disable the usersCanCreateNewCategories setting until a fix is available, which removes the precondition required to reach the vulnerable endpoint from non-admin accounts.
- Restrict the canUpload capability to trusted users and audit existing accounts holding this permission.
- Back up the videos/categories/assets/ directory tree so deleted assets can be restored if abuse is detected.
Patch Information
As of the advisory publication, no patched version of AVideo was available. Track the GitHub Security Advisory GHSA-gf2v-r8wx-ghqj and the VulnCheck Advisory on AVideo for updated remediation status and follow the upstream WWBN/AVideo repository for release notes.
Workarounds
- Block or restrict access to /objects/categoryDeleteAssets.json.php at the reverse proxy or web application firewall layer, permitting only administrative source addresses.
- Apply a local patch that adds a Category::userCanEditCategory() check to categoryDeleteAssets.json.php before calling Category::deleteAssets().
- Enforce strict filesystem permissions so the web server user cannot delete assets outside a narrow, expected path scope.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
