CVE-2026-34738

CVE-2026-34738 · AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

CVSS 4.3 · Средний · EPSS 0,2%

Опубликовано

2026-03-31T20:55:09.083Z

Обновлено

2026-04-01T15:53:23.775Z

Стек: php

Проверьте свой сервер →