CVE-2026-34738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34738", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T18:41:20.754Z", "datePublished": "2026-03-31T20:55:09.083Z", "dateUpdated": "2026-04-01T15:53:23.775Z"}, "containers": {"cna": {"title": "AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:55:09.083Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including \"active\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches."}], "source": {"advisory": "GHSA-m577-w9j8-ch7j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T15:46:27.176573Z", "id": "CVE-2026-34738", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T15:53:23.775Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34738", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T18:41:20.754Z", "datePublished": "2026-03-31T20:55:09.083Z", "dateUpdated": "2026-04-01T15:53:23.775Z"}, "containers": {"cna": {"title": "AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:55:09.083Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including \"active\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches."}], "source": {"advisory": "GHSA-m577-w9j8-ch7j", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34738", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T15:46:27.176573Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T15:46:35.881Z"}}]}}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including \"active\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 26.0 y anteriores, la canalizaci\u00f3n de procesamiento de video de AVideo acepta un par\u00e1metro de solicitud overrideStatus que permite a cualquier cargador establecer el estado de un video a cualquier estado v\u00e1lido, incluido 'activo' (a). Esto elude los flujos de trabajo de moderaci\u00f3n y borrador controlados por el administrador. El m\u00e9todo setStatus() valida el c\u00f3digo de estado contra una lista de valores conocidos, pero no verifica que el llamador tenga permiso para establecer ese estado en particular. Como resultado, cualquier usuario con permisos de carga puede publicar videos directamente, eludiendo los procesos de revisi\u00f3n de contenido. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "id": "CVE-2026-34738", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34738", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T15:46:27.176573Z", "version": "2.0.3"}}]}, "published": "2026-03-31T21:16:32.410", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-04-02T05:14:55.070456+00:00", "value": {"mitigation_remediation": ["Restrict upload permissions so only trusted users can submit videos.", "Remove or ignore the overrideStatus parameter from the server\u2011side upload handling code.", "Add server\u2011side checks that allow status changes to \"active\" only for administrators or users with explicit review rights.", "Monitor newly published videos for compliance with content policies.", "Keep the AVideo installation up\u2011to\u2011date by checking the WWBN repository for any patch or newer release that corrects the issue."], "summary": {"action": "Assess Impact", "impact": "Unauthorized video publication bypass"}, "threat_synthesis": {"affected_systems": "Affected users are those who have been granted upload permissions on installations of WWBN AVideo running version\u202f26.0 or earlier. Later releases have removed or secured the overrideStatus parameter. The vulnerability only exploits the upload functionality and does not require additional actions beyond creating or editing a video entry. Organizations that allow wide content contribution must review which accounts hold upload rights.", "description_and_impact": "The flaw in WWBN AVideo up through version\u202f26 permits any user with upload rights to supply an overrideStatus request parameter and set a video\u2019s status to any valid state, including the public\u2011visible \"active\" state. This action bypasses the administrator\u2011controlled moderation workflow, allowing unreviewed content to go live without subjecting it to policy checks. The weakness arises because the server validates the status value against an approved list but does not confirm that the caller has permission to apply that status, a classic unauthorized privilege escalation scenario (CWE\u2011285).", "risk_and_exploitability": "The CVSS base score of 4.3 places the vulnerability in the low\u2011moderate range of severity. The EPSS indicates a very low probability of exploitation, with a likelihood of less than 1\u202f%. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the flaw simply by submitting an upload request containing the overrideStatus parameter, without needing further privileges or internal access to the application. The impact is limited to processing videos that bypass moderation, potentially exposing the site to policy\u2011violating or inappropriate content."}}}}, "created": "2026-04-02T07:52:20.723924+00:00", "updated": "2026-04-02T20:10:36.163514+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}