https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:40:02.234414+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-278493 EUVD-2026-278493 2026-10-08T16:40:02.303749+00:00 EUVD-2026-278493 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34738 fkie_cve-2026-34738 2026-10-08T16:40:02.303807+00:00

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

 https://cve.radiocsirt.org/vuln/ghsa-m577-w9j8-ch7j GHSA-m577-w9j8-ch7j — AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter 2026-10-08T16:40:02.303881+00:00

Affected: Packagist: wwbn/avideo

## Summary

AVideo's video processing pipeline accepts an `overrideStatus` request parameter that allows any uploader to set a video's status to any valid state, including "active" (`a`). This bypasses the admin-controlled moderation and draft workflows. The `setStatus()` method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.

## Details

At `objects/video.php:1055-1056`, the video object checks for an `overrideStatus` parameter in the request and applies it directly:

```php if (!empty($_REQUEST['overrideStatus'])) { return $this->setStatus($_REQUEST['overrideStatus']); } ```

This code is reached from two entry points: - `objects/videoAddNew.json.php:157` - when adding a new video - `objects/aVideoEncoder.json.php:114` - when processing an encoded video

The `setStatus()` method validates that the provided status code is one of the recognized values (`a`, `k`, `i`, `h`, `e`, `x`, `d`, `t`, `u`, `s`, `r`, `f`, `b`, `p`, `c`) but does not perform any authorization check. It does not verify whether the calling user has permission to set a video to the requested status.

The relevant status codes include: - `a` - Active (published and publicly visible) - `k` - Draft (pending review) - `i` - Inactive - `e` - Encoding - `x` - Deleted - `u` - Unlisted

When an admin configu…