EUVD-2026-277182

fkie_cve-2026-33649

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access. As of time of publication, no known patched versions are available.

GHSA-g8x9-7mgh-7cvj — AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

Affected: Packagist: wwbn/avideo

## Summary

The `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access.

## Details

The root cause is a combination of three issues:

**1. `$_REQUEST` used instead of `$_POST` (accepts GET parameters):**

`plugin/Permissions/setPermission.json.php:14-24`: ```php $intvalList = array('users_groups_id','plugins_id','type','isEnabled'); foreach ($intvalList as $value) { if($_REQUEST[$value]==='true'){ $_REQUEST[$value] = 1; }else{ $_REQUEST[$value] = intval($_REQUEST[$value]); } }

$obj = new stdClass(); $obj->id = Permissions::setPermission($_REQUEST['users_groups_id'], $_REQUEST['plugins_id'], $_REQUEST['type'], $_REQUEST['isEnabled']); ```

The only authorization check is `User::isAdmin()` at line 10 — there is no CSRF token validation via `isGlobalTokenValid()`.

**2. Session cookies set to `SameSite=None`:**

`objects/include_config.php:134-141`: ```php if ($isHTTPS) { // SameSite=None is intentional: AVideo supports cross-origin iframe embedding ini_set('session.cookie_samesite', 'None'); ini_set('sess…

Most recent entries from all

EUVD-2026-277182

fkie_cve-2026-33649

GHSA-g8x9-7mgh-7cvj — AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification