Live › vulnerability › CVE-2026-114633
Go to dashboardWWBN AVideo before 29.4.0 lets accounts with delegated Users Admin rights delete or modify administrator accounts. An attacker holding that delegated role can call confirmDeleteUser.json.php or userAddNew.json.php to remove administrators, their videos, or demote them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running AVideo before 29.4.0 that grant delegated Users Admin rights to any account. Installations that only have full administrators and no delegated user admins are less exposed to this specific path, though the sources do not say that explicitly.
No product ranges from the sources yet.
29.4.0 are affected.29.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
This page as .md · .json · in your agent: get_signal("CVE-2026-114633")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.