CVE-2026-114633
WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
- State
- Published
- Severity
- 7.0 High
- Published
- Oct 22, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 21, 2026
Description
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
AVideoWWBN |
|
References
- GitHub Security Advisory (GHSA-mp89-8x4j-2grx)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.phpthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.