---
id: "CVE-2026-114633"
kind: "vulnerability"
aliases: ["CVE-2026-114633"]
title: "WWBN AVideo: delegated user admins can delete or demote administrators"
severity: "high"
cvss: 7.0
epss: 0.00314
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["avideo", "php", "runtime", "self-hosted"]
not_affected_if: ["default-config", "no-delegated-user-admins"]
published_at: "2026-10-22T02:16:55+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:37:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114633", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114633", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# WWBN AVideo: delegated user admins can delete or demote administrators

WWBN AVideo before 29.4.0 lets accounts with delegated Users Admin rights delete or modify administrator accounts. An attacker holding that delegated role can call confirmDeleteUser.json.php or userAddNew.json.php to remove administrators, their videos, or demote them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AVideo version in the project's version file or admin panel; versions below `29.4.0` are affected.
- List accounts that hold the delegated Users Admin role and confirm which of them should have it.

## Fix

- Upgrade AVideo to `29.4.0` or later.
- Until upgraded, remove the Users Admin delegation from accounts that do not need it.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114633
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114633

## From the sources

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_