{"id":"CVE-2026-126809","kind":"vulnerability","aliases":["CVE-2026-126809"],"related":[],"title":"WWBN AVideo: missing authorization lets uploaders copy and delete other users' videos","description":"WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.","summary":"AVideo through 29.7.1 has a missing authorization check in objects/import.json.php, so any uploader can import other users' MP4 files by pointing at any folder under videos/. An attacker can also list files, read sidecar descriptions, and delete victims' media.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AVideo","fixed":[],"affected":"<= 29.7.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","runtime","self-hosted","video-hosting","wwbn-avideo"],"not_affected_if":["default-config","fixed-version","import-mp4-disabled","no-uploader-accounts"],"how_to_check":"1. Version: AVideo <= 29.7.1 (and master before commit 02471a4) is affected. 2. Exposure needs the Import MP4 feature enabled: in Admin > Customize Advanced, doNotShowImportMP4Button must be false (default true, i.e. feature off). 3. Also needs accounts with upload permission. If the feature is off or no untrusted users can upload, you are not reachable.","fix":"No patched release as of the advisory (patched versions: none). Fix commit 02471a4ddab0c5e28d74784b89298e489c17aff0 on WWBN/AVideo adds ownership checks to objects/import.json.php and objects/listFiles.json.php; until a release includes it, run a build from that commit or later. Vendor workaround: keep Import MP4 disabled (doNotShowImportMP4Button = true).","status":"open","published_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:47+00:00","updated_at":"2026-11-11T21:31:44+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-11T21:30:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WWBN AVideo: missing authorization lets uploaders copy and delete other users' videos","impact":"high","summary":"AVideo through 29.7.1 has a missing authorization check in objects/import.json.php, so any uploader can import other users' MP4 files by pointing at any folder under videos/. An attacker can also list files, read sidecar descriptions, and delete victims' media.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wwbn-avideo","self-hosted","video-hosting"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker copies or deletes other users' private videos","analyst_note":"Find the fixed version and the patch commit in the linked GitHub fix and vendor advisory; the sources give no fixed version.","how_to_check":"- Check the installed AVideo version against the range in the sources (through `29.7.1` is affected)\n- Look for `objects/import.json.php` in the install and confirm whether uploader accounts can reach it\n- unknown for a configuration check, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-uploader-accounts","fixed-version"],"who_is_affected":"Sites running WWBN AVideo through 29.7.1 that let uploader accounts sign in. Any uploader can reach the import endpoint and read or delete media belonging to other users, including private and pay-per-view videos. Sites with no uploader accounts or on a later version are not affected by the sources' range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000762,"input_tokens":4654,"output_tokens":594,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the patch commit in the linked GitHub fix and vendor advisory; the sources give no fixed version.","search":"'-126809':15A,18A '-2026':14A,17A '29.7.1':35B,75C 'allow':84C 'also':62B 'attack':60B,98C 'auth':21B 'auth-requir':20B 'author':4A,39B,79C 'avideo':2A,19A,32B,33B,73C 'check':40B 'contain':76C 'copi':7A,100C 'cve':13A,16A 'delet':9A,69B,123C,128C 'descript':67B,117C 'file':51B,64B,91C,119C 'folder':56B,95C 'host':26B,29B 'import':47B,87C 'let':5A 'list':63B,118C 'media':71B,125C 'miss':3A,38B,78C 'mp4':50B,90C 'objects/import.json.php':42B,82C 'objects/listfiles.json.php':121C 'paramet':129C 'password':104C 'password-protect':103C 'pay':108C 'pay-per-view':107C 'per':109C 'point':53B 'privat':101C 'protect':105C 'read':65B,112C 'referenc':93C 'requir':22B 'runtim':23B 'self':25B 'self-host':24B 'sidecar':66B,115C 'txt/.html':114C 'unlist':102C 'upload':6A,45B,85C 'use':126C 'user':11A,49B,89C 'via':120C 'victim':70B,113C,124C 'video':12A,28B,58B,97C,111C 'video-host':27B 'view':110C 'vulner':80C 'wwbn':1A,31B,72C 'wwbn-avideo':30B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted WWBN AVideo up to and including 29.7.1 (and master before commit 02471a4) where an admin has turned on the Import MP4 feature and users other than admins have upload permission. Any uploader can then copy other users' private, unlisted, password-protected or pay-per-view videos into their own channel, read their description sidecars, and delete the originals. Instances with Import MP4 left at its default (disabled) or with no untrusted uploaders can skip it for now.","tier":"B","verified":{"fix":{"at":"2026-11-11T21:31:44Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0","run_id":3597},"products":{"at":"2026-11-11T21:31:44Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0","run_id":3597},"how_to_check":{"at":"2026-11-11T21:31:44Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0","run_id":3597},"who_affected":{"at":"2026-11-11T21:31:44Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0","run_id":3597}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["avideo"],"ptokens":["avideo"],"labels":["authrequired","high","runtime","selfhosted","videohosting","wwbnavideo"],"campaign_type":null,"search_a":"'-126809':15A,18A '-2026':14A,17A 'author':4A 'avideo':2A,19A 'copi':7A 'cve':13A,16A 'delet':9A 'let':5A 'miss':3A 'upload':6A 'user':11A 'video':12A 'wwbn':1A","search_b":"'29.7.1':35B 'also':62B 'attack':60B 'auth':21B 'auth-requir':20B 'author':39B 'avideo':32B,33B 'check':40B 'delet':69B 'descript':67B 'file':51B,64B 'folder':56B 'host':26B,29B 'import':47B 'list':63B 'media':71B 'miss':38B 'mp4':50B 'objects/import.json.php':42B 'point':53B 'read':65B 'requir':22B 'runtim':23B 'self':25B 'self-host':24B 'sidecar':66B 'upload':45B 'user':49B 'victim':70B 'video':28B,58B 'video-host':27B 'wwbn':31B 'wwbn-avideo':30B","search_c":"'29.7.1':75C 'allow':84C 'attack':98C 'author':79C 'avideo':73C 'contain':76C 'copi':100C 'delet':123C,128C 'descript':117C 'file':91C,119C 'folder':95C 'import':87C 'list':118C 'media':125C 'miss':78C 'mp4':90C 'objects/import.json.php':82C 'objects/listfiles.json.php':121C 'paramet':129C 'password':104C 'password-protect':103C 'pay':108C 'pay-per-view':107C 'per':109C 'privat':101C 'protect':105C 'read':112C 'referenc':93C 'sidecar':115C 'txt/.html':114C 'unlist':102C 'upload':85C 'use':126C 'user':89C 'via':120C 'victim':113C,124C 'video':97C,111C 'view':110C 'vulner':80C 'wwbn':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T16:24:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126809","severity":null,"published_at":"2026-11-11T21:16:45+00:00","modified_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126809:3597","url":null,"severity":null,"published_at":"2026-11-11T21:31:44+00:00","modified_at":"2026-11-11T21:31:44+00:00","first_seen_at":"2026-11-11T21:31:44+00:00","fetched_at":"2026-11-11T21:31:44+00:00","note":"Read GHSA-g69x-xc9q-2g2v: patched versions none; fix commit 02471a4 (adds ownership checks in import.json.php, listFiles.json.php, video.php) dated 2026-11-11, no release carrying it. Exploit needs Import MP4 enabled (off by default) and uploader account. Incomplete fix of CVE-2026-33493. No exploitation reported."}],"documents":[{"id":128983,"url":"https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128984,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-g69x-xc9q-2g2v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T16:24:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":128985,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-objects-import-json-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}