CVE-2026-34738
published 2026-03-31CVE-2026-34738: WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.24%
15.1th percentile
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WWBN AVideo up to 26.0 setStatus improper authorization (GHSA-m577-w9j8-ch7j)
vuldb·2026-07-26·CVSS 4.3
CVE-2026-34738 [MEDIUM] WWBN AVideo up to 26.0 setStatus improper authorization (GHSA-m577-w9j8-ch7j)
A vulnerability identified as critical has been detected in WWBN AVideo up to 26.0. The impacted element is the function setStatus. This manipulation causes improper authorization.
The identification of this vulnerability is CVE-2026-34738. It is possible to initiate the attack remotely. There is no exploit available.
OSV
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
osv·2026-04-01
CVE-2026-34738 [MEDIUM] AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
## Summary
AVideo's video processing pipeline accepts an `overrideStatus` request parameter that allows any uploader to set a video's status to any valid state, including "active" (`a`). This bypasses the admin-controlled moderation and draft workflows. The `setStatus()` method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.
## Details
At `objects/video.php:1055-1056`, the video object checks for an `overrideStatus` parameter in the request and applies it directly:
```php
if (!empty($_REQUEST[
GHSA
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
ghsa·2026-04-01
CVE-2026-34738 [MEDIUM] CWE-285 AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
## Summary
AVideo's video processing pipeline accepts an `overrideStatus` request parameter that allows any uploader to set a video's status to any valid state, including "active" (`a`). This bypasses the admin-controlled moderation and draft workflows. The `setStatus()` method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.
## Details
At `objects/video.php:1055-1056`, the video object checks for an `overrideStatus` parameter in the request and applies it directly:
```php
if (!empty($_REQUEST[
No detection rules found.
No public exploits indexed.
2026-03-31
Published