CSRF in AVideo via Release Video Endpoint

Executive Summary

CVE-2026-58003 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo software. It exists in the releaseVideoNow.json.php endpoint which lacks authenticity checks and accepts GET requests. Attackers can trick an administrator into visiting a malicious link or loading a malicious image to force-publish any embargoed video by manipulating the videos_id parameter. The vulnerability allows permanent disclosure of embargoed videos as the scheduler marks the video as executed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the AVideo application for the presence of the releaseVideoNow.json.php endpoint in the plugin/Scheduler directory. Check if the endpoint accepts GET requests and lacks CSRF token validation. Review server logs for suspicious GET requests targeting this endpoint with parameters like videos_id.

Useful 0 Not Useful 0

Impact Analysis

If you use WWBN AVideo, an attacker could exploit this to publish videos you intended to keep private. This could lead to unauthorized disclosure of sensitive or embargoed content. The attack requires tricking an authenticated administrator into interacting with a malicious request, but does not require the attacker to have an account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized publication of embargoed videos could result in data breaches, leading to regulatory penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest version that includes CSRF protection. Add CSRF token checks to the releaseVideoNow.json.php endpoint and ensure it rejects GET requests. Implement input validation for the videos_id parameter and restrict access to the endpoint to authenticated administrators only.

Useful 0 Not Useful 0