CVE-2026-40926

{
  "id": "CVE-2026-40926",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T23:16:20.163",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce only a role check (`Category::canCreateCategory()` / `User::isAdmin()`) and perform state-changing actions against the database without calling `isGlobalTokenValid()` or `forbidIfIsUntrustedRequest()`. Peer endpoints in the same directory (`pluginSwitch.json.php`, `pluginRunDatabaseScript.json.php`) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's `updateScript()` method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de código abierto. En las versiones 29.0 y anteriores, tres puntos finales JSON solo para administradores - ’objects/categoryAddNew.json.php’, ’objects/categoryDelete.json.php’ y ’objects/pluginRunUpdateScript.json.php’ - aplican solo una verificación de rol (’Category::canCreateCategory()’ / ’User::isAdmin()’) y realizan acciones que cambian el estado en la base de datos sin llamar a ’isGlobalTokenValid()’ o ’forbidIfIsUntrustedRequest()’. Puntos finales pares en el mismo directorio (’pluginSwitch.json.php’, ’pluginRunDatabaseScript.json.php’) sí aplican el token CSRF, por lo que las verificaciones faltantes son una omisión en lugar de una elección de diseño. Un atacante que atrae a un administrador con sesión iniciada a una página maliciosa puede crear, actualizar o eliminar categorías y forzar la ejecución del método ’updateScript()’ de cualquier plugin instalado en la sesión del administrador. El commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contiene una solución."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WWBN",
          "product": "AVideo",
          "versions": [
            {
              "version": "<= 29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T13:57:39.434922Z",
          "id": "CVE-2026-40926",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "29.0",
              "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/commit/ee5615153c40628ab3ec6fe04962d1f92e67d3e2",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-ffw8-fwxp-h64w",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-ffw8-fwxp-h64w",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}