A critical CSRF vulnerability in WWBN AVideo up to version 26.0 allows an unauthenticated attacker to achieve privilege escalation by inducing an administrator to visit a malicious webpage.

The application fails to implement CSRF token validation on the plugin/Permissions/setPermission.json.php endpoint and forces session.cookie_samesite=None, permitting an unauthenticated attacker to manipulate user group permissions via a crafted request executed by an administrator.

Successful exploitation allows an attacker to elevate their privileges to near-administrator status, granting them unauthorized control over the video platform. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to full system compromise, data theft, or service disruption, severely impacting organizational security posture.

Immediate Action: As no official patch is currently available, administrators should restrict access to the administrative dashboard and the vulnerable endpoint using network-level controls or IP allowlisting.

Proactive Monitoring: Review web server access logs for suspicious requests to the setPermission.json.php file, particularly those originating from external, unexpected sources.

Compensating Controls: Implement a strict Content Security Policy (CSP) and ensure that administrative sessions are protected by robust authentication and session management practices, or place the application behind a WAF configured to block cross-origin state-changing requests.

Public Exploit Available: Unknown

Due to the lack of a vendor-supplied patch, organizations relying on WWBN AVideo must treat this vulnerability with extreme urgency. Administrators should apply the recommended compensating controls immediately to prevent unauthorized privilege escalation and continue monitoring official vendor channels for the release of a security update.