Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any authentication or authorization check, allowing unauthenticated users to retrieve the complete permission matrix mapping user groups to plugins. All sibling endpoints in the same directory (`add.json.php`, `delete.json.php`, `index.php`) properly require `User::isAdmin()`, indicating this is an oversight. Commits dc3c825734628bb32550d0daa125f05bacb6829c and b583acdc9a9d1eab461543caa363e1a104fb4516 contain patches.

INFO

Published Date :

2026-03-23T16:28:20.513Z

Last Modified :

2026-03-25T14:18:32.194Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-33501 vulnerability.

Vendors Products
Wwbn
  • Avideo
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-33501.

URL Resource
https://github.com/WWBN/AVideo/commit/b583acdc9a9d1eab461543caa363e1a104fb4516 cve-icon cve-icon
https://github.com/WWBN/AVideo/commit/dc3c825734628bb32550d0daa125f05bacb6829c cve-icon cve-icon
https://github.com/WWBN/AVideo/security/advisories/GHSA-96qp-8cmq-jvq8 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact