CVE-2026-34738 PUBLISHED

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Assigner: GitHub_M
Reserved: 30.03.2026 Published: 31.03.2026 Updated: 31.03.2026

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Product Status

Vendor WWBN
Product AVideo
Versions
  • Version <= 26.0 is affected

References

Problem Types

  • CWE-285: Improper Authorization CWE