WWBN AVideo, an open-source video platform, suffers from an incorrect authorization vulnerability identified as CVE-2026-33650 (CWE-863) affecting versions up to and including 26.0. The vulnerability stems from improper permission checks in the platform's video management APIs. Specifically, the 'Videos Moderator' role is documented to allow only publicity status changes (Active, Inactive, Unlisted) but due to flawed authorization logic, users with this role can escalate privileges. The function Permissions::canModerateVideos() is used as the gatekeeper for full video editing in videoAddNew.json.php, but videoDelete.json.php only verifies video ownership without checking moderator permissions. This asymmetry allows a malicious moderator to first transfer ownership of any video to themselves and then delete it, bypassing intended restrictions. The exploit requires only low privileges and no user interaction, making it relatively easy to execute. The vulnerability impacts confidentiality (limited), integrity (high, due to unauthorized modifications), and availability (low, due to deletions). A patch has been committed (commit 838e16818c793779406ecbf34ebaeba9830e33f8) to correct the authorization checks and prevent privilege escalation.

The vulnerability enables unauthorized users with limited moderator permissions to escalate their privileges and perform destructive actions such as transferring ownership and deleting any video on the platform. This can lead to significant integrity violations by allowing malicious actors to alter or remove content without authorization. Availability is also affected as videos can be deleted, potentially disrupting service and user experience. Confidentiality impact is limited since the vulnerability does not grant access to private data but could indirectly affect trust in the platform. Organizations relying on WWBN AVideo for video hosting and management risk content loss, reputational damage, and operational disruption. Attackers exploiting this flaw could manipulate or remove critical video assets, impacting educational, entertainment, or corporate communications hosted on the platform.

Organizations should immediately update WWBN AVideo to the latest patched version that addresses CVE-2026-33650. If immediate patching is not possible, restrict the 'Videos Moderator' permission to trusted users only and monitor their activities closely. Implement additional access control layers such as web application firewalls (WAFs) to detect and block suspicious API calls related to video ownership transfer and deletion. Conduct thorough audits of user permissions and video ownership records to detect unauthorized changes. Employ logging and alerting mechanisms to identify unusual patterns of video edits or deletions. Review and harden authorization logic in custom deployments or forks of AVideo to ensure consistent permission checks across all video management endpoints. Finally, educate administrators and moderators about the risks of privilege escalation and enforce the principle of least privilege.