A privilege escalation vulnerability in WWBN AVideo allows authenticated users with the Videos Moderator role to perform unauthorized management operations, including the deletion of any video content.

This is an incorrect authorization flaw (CWE-863) where the application fails to enforce proper permission checks in the videoAddNew.json.php and videoDelete.json.php endpoints. An authenticated user assigned the Videos Moderator role can exploit an asymmetric authorization boundary to perform actions beyond their intended scope, such as ownership transfer and deletion.

The vulnerability carries a CVSS score of 7.6, indicating a High severity risk. Successful exploitation allows for the unauthorized modification or deletion of video assets, which can lead to significant data loss, service disruption, and potential reputational damage for organizations relying on the platform for content hosting.

Immediate Action: As no official patched release version is currently listed, administrators should restrict access to the Videos Moderator role and monitor for unusual activity. Apply the upstream fix provided in commit 838e16818c793779406ecbf34ebaeba9830e33f8 if you maintain a local build.

Proactive Monitoring: Review application access logs for frequent or unauthorized calls to videoAddNew.json.php and videoDelete.json.php by accounts with limited privileges. Monitor for unexpected changes in video ownership or mass deletion events.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to the aforementioned JSON endpoints to only trusted administrative IP addresses. Ensure that the principle of least privilege is applied to all user roles within the AVideo platform.

Public Exploit Available: Unknown.

Given the High severity of this authorization bypass, organizations should treat this as a priority issue. Administrators should audit their user access controls immediately to ensure that only trusted personnel hold the Videos Moderator role while awaiting an official vendor patch. Applying the provided code-level fix is strongly recommended to eliminate the underlying logic error.