PT-2026-27172 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33650

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. A user with the "Videos Moderator" permission can escalate privileges to perform full video management operations, including ownership transfer and deletion of any video, despite the permission being documented as only allowing video publicity changes. This is due to an asymmetric authorization boundary where Permissions::canModerateVideos() is used for full video editing in videoAddNew.json.php, while videoDelete.json.php only checks ownership. This allows exploitation through a two-step ownership-transfer-then-delete chain. The vulnerable function is Permissions::canModerateVideos().

Recommendations Update to a version beyond 26.0.

Exploit

Correção

LPE

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-33650

GHSA-8X77-F38V-4M5J

Produtos afetados

Avideo

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33650.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-8x77-f38v-4m5j · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/838e16818c793779406ecbf34ebaeba9830e33f8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-33650 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2036178794696835333 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33650 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8x77-f38v-4m5j · Aviso do Fabricante