Executive brief
WWBN AVideo is a video content management platform. The platform fails to verify whether users have permission to access password-protected or group-restricted videos when accepting comments. This allows authenticated users to post comments on videos they cannot watch, potentially enabling harassment, spam, or reputational damage to video owners.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the commentAddNew.json.php endpoint. The endpoint verifies that a user can comment via User::canComment() but does not call User::canWatchVideo() or enforce video password requirements before allowing a comment to be posted. An authenticated attacker can submit a POST request with a valid session cookie and video ID to add comments to password-protected or group-restricted videos, bypassing access controls that apply to the watch endpoint. The vulnerability affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no patch was available at the time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-28: disclosed
- 2026-09-12: advisory