PT-2026-30284 · Meta+1 · Facebook Graph Api+3

Adrgs

·

Published

2026-04-03

·

Updated

2026-04-06

·

CVE-2026-35179

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AVideo versions 26.0 and prior are affected by an issue in the SocialMediaPublisher plugin. The publishInstagram.json.php endpoint functions as an unauthenticated proxy to the Facebook/Instagram Graph API. This endpoint accepts user-controlled parameters, including the accessToken, containerId, and instagramAccountId, and directly passes them to the Graph API via the InstagramUploader::publishMediaIfIsReady() function. This allows unauthenticated users to make arbitrary Graph API calls through the server, potentially using stolen tokens or the platform's own credentials. The endpoint lacks authorization checks, unlike other endpoints in the same plugin that require user login or administrator privileges. An attacker can leverage this to publish, modify, or delete content on the platform's Instagram account. The server's IP address is used for the API calls, potentially bypassing rate limits or IP-based restrictions on the Graph API.
Recommendations: Add an administrator authorization check at the top of plugin/SocialMediaPublisher/publishInstagram.json.php:10, consistent with the refresh.json.php endpoint. This will restrict access to the endpoint to administrator users only.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35179
GHSA-X9W5-XCCW-5H9W

Affected Products

Avideo
Facebook Graph Api
Instagram Graph Api
Socialmediapublisher