PT-2026-28534 · Unknown+1 · Avideo Ai Plugin+1

Offset · Published 2026-03-26 · Updated 2026-03-27 · CVE-2026-33764

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description The AVideo platform’s AI plugin contains a flaw in the save.json.php endpoint. This endpoint loads AI response objects using the $ REQUEST['id'] parameter, which is controlled by the attacker, without verifying that the AI response belongs to the specified video. An authenticated user with AI permissions can reference AI response IDs from other users’ private videos and apply the stolen AI-generated content—including titles, descriptions, keywords, summaries, and full transcriptions—to their own video, effectively exfiltrating the information. The vulnerability exists because the authorization flow checks that the user can edit the target video, but does not validate ownership when loading the AI response object. The ObjectYPT base class constructor performs a database lookup without any permission checks. The save.json.php endpoint utilizes the $ REQUEST['id'] parameter to load AI responses, and the loaded data is then applied to the attacker’s video using functions like $video->setTitle() and file put contents(). The delete.json.php endpoint correctly validates ownership, demonstrating that the developers intended to implement ownership validation but omitted it in the save endpoint. An attacker can enumerate AI response IDs to steal metadata and even the full transcription of private videos. This can lead to a confidentiality breach of private video content and metadata exfiltration.

Recommendations Versions prior to 26.1 should implement ownership validation in save.json.php to match the validation present in delete.json.php. Specifically, load the parent Ai responses record and verify that getVideos id() matches the provided $videos id.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33764

GHSA-G39V-QRJ6-JXRH

Affected Products

Avideo

Avideo Ai Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33764.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-g39v-qrj6-jxrh · Exploit
• https://github.com/WWBN/AVideo/commit/aa2c46a806960a0006105df47765913394eec142 · Patch
• https://osv.dev/vulnerability/CVE-2026-33764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33764 · Security Note
• https://osv.dev/vulnerability/GHSA-g39v-qrj6-jxrh · Vendor Advisory
• https://github.com/WWBN/AVideo · Note