Vulnerability Description
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/commit/9c7cadaee8f472e9f6584b941af1bdaed5668145
- https://github.com/WWBN/AVideo/security/advisories/GHSA-mp89-8x4j-2grx
- https://www.vulncheck.com/advisories/wwbn-avideo-before-29.4.0-incorrect-authori
- https://github.com/WWBN/AVideo/security/advisories/GHSA-mp89-8x4j-2grx
FAQ
What is CVE-2026-114633?
CVE-2026-114633 is a vulnerability with a CVSS score of 6.5 (MEDIUM). WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to conf...
How severe is CVE-2026-114633?
CVE-2026-114633 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114633?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.