CVE-2026-89257: Authorization Bypass Through User-Controlled Key in WWBN AVideo
AVideo versions up to 29.0 contain an insecure direct object reference (IDOR) vulnerability in the categoryDeleteAssets.json.php endpoint. This flaw allows authenticated non-admin users with the canUpload capability to delete on-disk asset directories of arbitrary categories by supplying a crafted category ID. The vulnerability arises because the endpoint checks only the ability to create categories and a CSRF nonce but omits the ownership check required for deletion. Category records and videos themselves are not affected. No patch is available as of the advisory publication.
AI Analysis
Technical Summary
CVE-2026-89257 is an IDOR vulnerability in WWBN AVideo through version 29.0, specifically in the objects/categoryDeleteAssets.json.php endpoint. The endpoint validates the Category::canCreateCategory() capability and a CSRF nonce but fails to enforce the Category::userCanEditCategory() ownership check before calling Category::deleteAssets(). This omission allows an authenticated non-admin user with the canUpload capability, on installations where usersCanCreateNewCategories is enabled, to send a POST request with an arbitrary category ID and recursively delete the corresponding on-disk asset directory (icons/images) under {systemRootPath}videos/categories/assets/{id}/. The vulnerability does not affect category records or video data. No patched version is available at the time of the advisory.
Potential Impact
An authenticated non-admin user with the canUpload capability can delete on-disk asset directories of arbitrary categories, potentially causing loss of category icons and images. This could affect the visual representation of categories but does not delete category metadata or video content. The impact is limited to asset files on disk.
Mitigation Recommendations
No official patch or fix is available as of the advisory publication. Users should monitor the vendor advisory for updates. Until a fix is released, consider restricting the canUpload capability to trusted users and disabling the usersCanCreateNewCategories setting if not required to reduce exposure.
CVE-2026-89257: Authorization Bypass Through User-Controlled Key in WWBN AVideo
Description
AVideo versions up to 29.0 contain an insecure direct object reference (IDOR) vulnerability in the categoryDeleteAssets.json.php endpoint. This flaw allows authenticated non-admin users with the canUpload capability to delete on-disk asset directories of arbitrary categories by supplying a crafted category ID. The vulnerability arises because the endpoint checks only the ability to create categories and a CSRF nonce but omits the ownership check required for deletion. Category records and videos themselves are not affected. No patch is available as of the advisory publication.
CVSS v4.0
Score 5.3medium
Affected software
WWBN
AVideo
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-89257 is an IDOR vulnerability in WWBN AVideo through version 29.0, specifically in the objects/categoryDeleteAssets.json.php endpoint. The endpoint validates the Category::canCreateCategory() capability and a CSRF nonce but fails to enforce the Category::userCanEditCategory() ownership check before calling Category::deleteAssets(). This omission allows an authenticated non-admin user with the canUpload capability, on installations where usersCanCreateNewCategories is enabled, to send a POST request with an arbitrary category ID and recursively delete the corresponding on-disk asset directory (icons/images) under {systemRootPath}videos/categories/assets/{id}/. The vulnerability does not affect category records or video data. No patched version is available at the time of the advisory.
Potential Impact
An authenticated non-admin user with the canUpload capability can delete on-disk asset directories of arbitrary categories, potentially causing loss of category icons and images. This could affect the visual representation of categories but does not delete category metadata or video content. The impact is limited to asset files on disk.
Mitigation Recommendations
No official patch or fix is available as of the advisory publication. Users should monitor the vendor advisory for updates. Until a fix is released, consider restricting the canUpload capability to trusted users and disabling the usersCanCreateNewCategories setting if not required to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-11T10:51:59.215Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa3e6e091cc7f38481866c6
Added to database: 09/11/2026, 11:32:48 UTC
Last enriched: 09/11/2026, 11:47:36 UTC
Last updated: 09/11/2026, 15:15:27 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.