PT-2026-29365 · Avideo · Avideo

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34738

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.0

Description AVideo is an open source video platform. Versions 26.0 and earlier allow any uploader to set a video’s status to any valid state, including "active", through the overrideStatus request parameter. This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. The vulnerable parameter is overrideStatus.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-34738

GHSA-M577-W9J8-CH7J

Affected Products

Avideo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34738.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j · Exploit
• https://osv.dev/vulnerability/GHSA-m577-w9j8-ch7j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34738 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/34f0237e2449d2e564a69fe3c5c71c830f5d11fd · Note
• https://twitter.com/cyberbivash/status/2039091916839501990 · Twitter Post
• https://twitter.com/CVEnew/status/2039372116936573287 · Twitter Post