CVE-2026-107430 in Site Manager Plugin
Summary
by MITRE • 10/12/2026
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in VideoWhisper.com's Site Manager for AI integrations such as ChatGPT, Claude, and Codex represents a critical failure in access control mechanisms, specifically categorized under CWE-862: Missing Authorization. This flaw affects versions of the software ranging from its initial release through version 1.2.10. The core technical issue lies in the application's inability to properly enforce security levels when handling requests related to administrative or sensitive configuration tasks. In a secure architecture, every action performed by a user must be validated against their assigned privileges and role within the system. However, in this instance, the server-side logic fails to verify whether the authenticated user possesses the necessary permissions before executing operations that modify site settings, manage AI model configurations, or access restricted data. This oversight allows any authenticated user, regardless of their actual role, to perform actions intended only for administrators or higher-privileged accounts.
From a technical perspective, this vulnerability stems from an incorrectly configured access control security level within the application's backend logic. The system likely relies on client-side checks or lacks explicit server-side validation for specific endpoints associated with AI model management and site configuration. When a user sends a request to modify settings such as API keys, model selection parameters, or chat history configurations, the application processes these requests without adequately checking if the session token corresponds to an account with elevated privileges. This type of flaw is often referred to as Insecure Direct Object Reference (IDOR) when it involves accessing specific resources, but in this context, it manifests more broadly as a horizontal or vertical privilege escalation due to missing authorization checks on administrative functions. The absence of these checks means that the security boundary between standard users and administrators is effectively non-existent for certain operations within the Site Manager interface.
The operational impact of this vulnerability is severe, particularly given the nature of the software's function. VideoWhisper Site Manager serves as a central hub for managing AI-driven chat interfaces, which often handle sensitive user interactions and potentially proprietary data. An attacker who exploits this missing authorization can escalate their privileges to gain full administrative control over the affected instance. This could lead to unauthorized modification of system configurations, such as altering API endpoints or injecting malicious prompts into the AI models. Furthermore, if the application integrates with external services that store credentials or sensitive user information, an attacker could potentially exfiltrate this data by manipulating configuration settings or accessing restricted logs and management panels. The ability to change administrative settings also allows for persistent backdoors, such as creating new admin accounts or disabling security features like two-factor authentication or IP whitelisting, thereby compromising the long-term integrity of the deployment.
This vulnerability aligns with several entries in the MITRE ATT&CK framework, most notably T1078: Valid Accounts and T1098: Account Manipulation. An attacker would first obtain valid credentials through phishing, credential stuffing, or other means to establish a foothold as a low-privileged user. Once authenticated, they would exploit the missing authorization check (T1548: Abuse Elevation Control Mechanism) to escalate privileges and perform administrative actions without detection by standard security monitoring tools that rely on role-based access control logs. The exploitation does not require complex code injection or buffer overflow techniques; instead, it relies on simple HTTP request manipulation where an attacker modifies parameters in API calls or form submissions associated with the Site Manager's administrative functions. This simplicity makes the vulnerability highly exploitable and increases the risk of widespread compromise across instances running affected versions.
Mitigation strategies must focus on immediate remediation through software updates and enhanced security configurations. The primary solution is to upgrade VideoWhisper Site Manager to a version later than 1.2.10, where this authorization flaw has presumably been addressed by implementing robust server-side access control checks for all administrative endpoints. Until an update is available or if the vendor does not provide one, administrators should implement compensating controls at the network and application layers. This includes deploying Web Application Firewalls (WAF) with rules that detect abnormal patterns in requests to administrative URLs from non-administrator IP addresses or user agents. Additionally, enforcing strict role-based access control policies within any reverse proxy or load balancer can help restrict access to sensitive management interfaces based on identity verification rather than relying solely on the application's internal logic. Regular security audits and penetration testing should be conducted to identify similar authorization flaws in other modules of the platform, ensuring that all API endpoints are properly secured against unauthorized access attempts.