---
id: "CVE-2026-126809"
page: "https://infrastack.ai/live/CVE-2026-126809"
kind: "vulnerability"
aliases: ["CVE-2026-126809"]
title: "WWBN AVideo: missing authorization lets uploaders copy and delete other users' videos"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "AVideo", "fixed": [], "affected": "<= 29.7.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "runtime", "self-hosted", "video-hosting", "wwbn-avideo"]
not_affected_if: ["default-config", "fixed-version", "import-mp4-disabled", "no-uploader-accounts"]
published_at: "2026-11-11T21:16:45+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:31:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126809", "first_seen_at": "2026-11-11T21:29:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T21:31:44+00:00"}]
exploit_sources: []
---

# WWBN AVideo: missing authorization lets uploaders copy and delete other users' videos

Link for people: https://infrastack.ai/live/CVE-2026-126809 (this .md is for agents)

AVideo through 29.7.1 has a missing authorization check in objects/import.json.php, so any uploader can import other users' MP4 files by pointing at any folder under videos/. An attacker can also list files, read sidecar descriptions, and delete victims' media.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AVideo affected <= 29.7.1 fixed no fixed version listed

## How to check

1. Version: AVideo <= 29.7.1 (and master before commit 02471a4) is affected. 2. Exposure needs the Import MP4 feature enabled: in Admin > Customize Advanced, doNotShowImportMP4Button must be false (default true, i.e. feature off). 3. Also needs accounts with upload permission. If the feature is off or no untrusted users can upload, you are not reachable.

## Fix

No patched release as of the advisory (patched versions: none). Fix commit 02471a4ddab0c5e28d74784b89298e489c17aff0 on WWBN/AVideo adds ownership checks to objects/import.json.php and objects/listFiles.json.php; until a release includes it, run a build from that commit or later. Vendor workaround: keep Import MP4 disabled (doNotShowImportMP4Button = true).

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126809
- 2026-11-11T21:31:44+00:00 analyst — Read GHSA-g69x-xc9q-2g2v: patched versions none; fix commit 02471a4 (adds ownership checks in import.json.php, listFiles.json.php, video.php) dated 2026-11-11, no release carrying it. Exploit needs Import MP4 enabled (off by default) and uploader account. Incomplete fix of CVE-2026-33493. No exploitation reported.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-g69x-xc9q-2g2v
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-objects-import-json-php
- [fix] Patch: github.com https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0

## From the sources

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_