CVE-2026-33684

Deferred Deferred - Pending Action

Privilege Escalation in WWBN AVideo via Unauthenticated API Parameters

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows any user who can solve a CAPTCHA to self-grant elevated permissions during account registration. The set_api_signUp method in the API plugin accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input and applies them to newly created accounts without verifying that the request was authenticated with a valid APISecret. By self-granting account attributes, attackers can mark their own accounts as email-verified without owning the address (bypassing email-gated functionality) and award themselves upload, streaming, and meeting-creation permissions, circumventing administrator access controls that intentionally restrict these capabilities for new users. This issue has been fixed in version 29.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-33684

Affected Vendors & Products

Vendor	Product	Version / Range
wwbn	avideo	29.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in WWBN AVideo before version 29.0 allows privilege escalation during account registration. Attackers can self-grant elevated permissions like email verification, upload, streaming, and meeting creation by manipulating parameters in the signUp API. This happens because the API does not verify if the request comes from a valid APISecret before applying these permissions.

Detection Guidance

To detect this vulnerability, check if your AVideo instance is running a version prior to 29.0. Inspect API calls to signUp for unguarded permission parameters like emailVerified, canUpload, canStream, or canCreateMeet. Monitor for unauthorized privilege escalations during account registration.

Impact Analysis

An attacker could create an account with elevated privileges without proper authorization. This includes bypassing email verification, gaining upload and streaming rights, or creating meetings, even if the administrator restricted these capabilities for new users.

Compliance Impact

This vulnerability could lead to unauthorized access and data manipulation, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA. Unauthorized privilege escalation may result in improper handling of sensitive data.

Mitigation Strategies

Immediately upgrade AVideo to version 29.0 or later. Review and restrict API access to prevent unguarded permission parameter manipulation. Audit user accounts for unauthorized privilege escalations and revoke elevated permissions if detected.

Hi! I’m here to help you understand CVE-2026-33684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70