Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-114633WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
Medium 6.5
In plain English
A medium-severity incorrect authorization in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 61.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
References
- GitHub Security Advisory (GHSA-mp89-8x4j-2grx) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php third-party-advisory