CVE-2026-34738 in WWBN AVideo

요약 (영어)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

책임이 있는

GitHub_M

예약하다

2026. 03. 30.

공개

2026. 04. 01.

엔트리

VulDB provides additional information and datapoints for this CVE:

아이디	취약성	CWE	악용	대책	CVE
354560	WWBN AVideo setStatus 권한 상승	285	정의되지 않음	정의되지 않음	CVE-2026-34738