{"id":"CVE-2026-114633","kind":"vulnerability","aliases":["CVE-2026-114633"],"related":[],"title":"WWBN AVideo: delegated user admins can delete or demote administrators","description":"WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.","summary":"WWBN AVideo before 29.4.0 lets accounts with delegated Users Admin rights delete or modify administrator accounts. An attacker holding that delegated role can call confirmDeleteUser.json.php or userAddNew.json.php to remove administrators, their videos, or demote them.","severity":"high","cvss":7.0,"epss":0.00314,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","php","runtime","self-hosted"],"not_affected_if":["default-config","no-delegated-user-admins"],"how_to_check":"- Check the installed AVideo version in the project's version file or admin panel; versions below `29.4.0` are affected.\n- List accounts that hold the delegated Users Admin role and confirm which of them should have it.","fix":"- Upgrade AVideo to `29.4.0` or later.\n- Until upgraded, remove the Users Admin delegation from accounts that do not need it.","status":"open","published_at":"2026-10-22T02:16:55+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:37:01+00:00","updated_at":"2026-10-25T03:37:01+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:37:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo to `29.4.0` or later.\n- Until upgraded, remove the Users Admin delegation from accounts that do not need it.","reach":"internet","title":"WWBN AVideo: delegated user admins can delete or demote administrators","impact":"medium","summary":"WWBN AVideo before 29.4.0 lets accounts with delegated Users Admin rights delete or modify administrator accounts. An attacker holding that delegated role can call confirmDeleteUser.json.php or userAddNew.json.php to remove administrators, their videos, or demote them.","category":"runtime","nicknames":[],"who_cares":["avideo","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker removes or demotes administrators and deletes their videos and accounts","analyst_note":"Confirm the exact affected version range and whether a patch commit or advisory exists at the NVD link; sources do not give a fixed patch URL.","how_to_check":"- Check the installed AVideo version in the project's version file or admin panel; versions below `29.4.0` are affected.\n- List accounts that hold the delegated Users Admin role and confirm which of them should have it.","needs_analyst":true,"not_affected_if":["default-config","no-delegated-user-admins"],"who_is_affected":"Sites running AVideo before 29.4.0 that grant delegated Users Admin rights to any account. Installations that only have full administrators and no delegated user admins are less exposed to this specific path, though the sources do not say that explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3377,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114633':13A,16A '-2026':12A,15A '29.4.0':26B,60C 'account':28B,38B,71C,77C,93C 'admin':5A,32B,70C 'administr':10A,37B,52B,76C,87C 'allow':67C 'attack':40B,78C 'author':64C 'avideo':2A,17B,24B,58C 'call':46B 'chang':95C 'confirmdeleteuser.json.php':47B,83C 'contain':61C 'cve':11A,14A 'deleg':3A,30B,43B,68C 'delet':7A,34B,73C,89C 'demot':9A,56B,97C 'hold':41B 'host':22B 'incorrect':63C 'let':27B 'modifi':36B,75C 'php':18B 'remov':51B 'request':81C 'right':33B 'role':44B 'runtim':19B 'self':21B 'self-host':20B 'submit':80C 'target':86C 'user':4A,31B,69C 'useraddnew.json.php':49B,85C 'video':54B,91C 'vulner':65C 'wwbn':1A,23B,57C","nicknames":[],"mitigations":[],"who_affected":"Sites running AVideo before 29.4.0 that grant delegated Users Admin rights to any account. Installations that only have full administrators and no delegated user admins are less exposed to this specific path, though the sources do not say that explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114633","severity":null,"published_at":"2026-10-22T02:16:55+00:00","modified_at":"2026-10-22T15:38:50+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114633","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114633","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}