https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 15:49:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278493 EUVD-2026-278493 https://cve.radiocsirt.org/vuln/euvd-2026-278493 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34738 <p>WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo&#39;s video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video&#39;s status to any valid state, including &#34;active&#34; (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.</p> <p>WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo&#39;s video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video&#39;s status to any valid state, including &#34;active&#34; (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34738 https://cve.radiocsirt.org/vuln/ghsa-m577-w9j8-ch7j <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>AVideo&#39;s video processing pipeline accepts an `overrideStatus` request parameter that allows any uploader to set a video&#39;s status to any valid state, including &#34;active&#34; (`a`). This bypasses the admin-controlled moderation and draft workflows. The `setStatus()` method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.</p> <p>## Details</p> <p>At `objects/video.php:1055-1056`, the video object checks for an `overrideStatus` parameter in the request and applies it directly:</p> <p>```php if (!empty($_REQUEST[&#39;overrideStatus&#39;])) { return $this-&gt;setStatus($_REQUEST[&#39;overrideStatus&#39;]); } ```</p> <p>This code is reached from two entry points: - `objects/videoAddNew.json.php:157` - when adding a new video - `objects/aVideoEncoder.json.php:114` - when processing an encoded video</p> <p>The `setStatus()` method validates that the provided status code is one of the recognized values (`a`, `k`, `i`, `h`, `e`, `x`, `d`, `t`, `u`, `s`, `r`, `f`, `b`, `p`, `c`) but does not perform any authorization check. It does not verify whether the calling user has permission to set a video to the requested status.</p> <p>The relevant status codes include: - `a` - Active (published and publicly visible) - `k` - Draft (pending review) - `i` - Inactive - `e` - Encoding - `x` - Deleted - `u` - Unlisted</p> <p>When an admin configu…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>AVideo&#39;s video processing pipeline accepts an `overrideStatus` request parameter that allows any uploader to set a video&#39;s status to any valid state, including &#34;active&#34; (`a`). This bypasses the admin-controlled moderation and draft workflows. The `setStatus()` method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.</p> <p>## Details</p> <p>At `objects/video.php:1055-1056`, the video object checks for an `overrideStatus` parameter in the request and applies it directly:</p> <p>```php if (!empty($_REQUEST[&#39;overrideStatus&#39;])) { return $this-&gt;setStatus($_REQUEST[&#39;overrideStatus&#39;]); } ```</p> <p>This code is reached from two entry points: - `objects/videoAddNew.json.php:157` - when adding a new video - `objects/aVideoEncoder.json.php:114` - when processing an encoded video</p> <p>The `setStatus()` method validates that the provided status code is one of the recognized values (`a`, `k`, `i`, `h`, `e`, `x`, `d`, `t`, `u`, `s`, `r`, `f`, `b`, `p`, `c`) but does not perform any authorization check. It does not verify whether the calling user has permission to set a video to the requested status.</p> <p>The relevant status codes include: - `a` - Active (published and publicly visible) - `k` - Draft (pending review) - `i` - Inactive - `e` - Encoding - `x` - Deleted - `u` - Unlisted</p> <p>When an admin configu…</p> https://cve.radiocsirt.org/vuln/ghsa-m577-w9j8-ch7j