PT-2026-29365 · Wwbn · Avideo

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-34738

Mitre

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-34738

Affected Products

Avideo

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-34738 · Security Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j · Note