Executive brief
WWBN AVideo is a video hosting and management platform. An authenticated attacker can forge two-party consent records by manipulating the Users_affiliations endpoint, and then use these forged records to reassign video ownership to arbitrary users. This allows an attacker to publish content under another user's account without authorization, potentially damaging reputation and enabling account takeover.
Technical details
The vulnerability exists in the `Users_affiliations/add.json.php` endpoint, which implements insufficient authorization checks (CWE-862, CWE-639). An authenticated user can forge a two-party consent record by supplying the counterparty's agreement timestamp; the endpoint only pins the caller's own side of the record and leaves the victim's user ID and agreement date attacker-controlled. Once a forged affiliation with status='a' is created, the `videoAddNew.json.php` endpoint trusts it as an authorization term and allows the attacker to reassign video ownership via `setUsers_id()`. The vulnerable code branches on caller type but fails to validate the opposite party's consent, whereas sibling endpoints (`confirm.json.php`, `delete.json.php`) correctly implement `canEditAffiliation()` checks. The issue affects default installations where CustomizeUser is active and self-registration permits uploads. Attack requires one registered account; victim user IDs are sequential integers and predictable.
Affected products
- WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732
Timeline
- 2026-08-22: disclosed
- 2026-08-07: advisory: GitHub Security Advisory GHSA-rg7g-cgjq-4wx8 published