CVE-2026-114633: WWBN AVideo incorrect authorization in admin account management

CVE-2026-114633 · Severity: medium · CVSS 6.5 · Published 2026-10-22

WWBN AVideo is a self-hosted video platform that manages user accounts and permissions. An attacker with delegated "Users Admin" access could delete or modify administrator accounts—removing their videos, changing their credentials, or demoting them—despite not being an administrator themselves. This could block legitimate administrative access and destroy critical content.

Technologies: WWBN AVideo. Vendors: WWBN.

Quick answers

Is CVE-2026-114633 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114633 being exploited in the wild.
How severe is CVE-2026-114633?
Medium severity, with a CVSS score of 6.5, published 22 October 2026.
Which products and versions are affected?
WWBN AVideo before 29.4.0 (commit 9c7cada).
Is there a fix for CVE-2026-114633?
Yes: fixed in commit 9c7cadaee8f472e9f6584b941af1bdaed5668145 or later; no numbered release verified. Until then: Remove the delegated Users Admin permission from non-administrator accounts until the application is updated. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114633 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-114633?
Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: commit 9c7cadaee8f472e9f6584b941af1bdaed5668145 or later; no numbered release verified

Remove the delegated Users Admin permission from non-administrator accounts until the application is updated.

Technical details

The vulnerability is an authorization bypass in the user deletion endpoint (confirmDeleteUser.json.php) and account editing endpoint (userAddNew.json.php) that fails to verify the target's administrator status. A delegated Users Admin account can submit authenticated requests with valid CAPTCHA and security tokens to delete administrator accounts or modify their fields, bypassing the administrator boundary. The fix implements UserAccountMutationLock to serialize mutations and re-check the target's administrator flag to prevent concurrent privilege-escalation race conditions.

Affected products

  • WWBN AVideo before 29.4.0 (commit 9c7cada)

Timeline

  • 2026-10-07: disclosed
  • 2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.