Technical impact
The in WWBN AVideo allows a delegated user with administrative privileges to override authorization checks and delete or modify any administrator account. By submitting requests to confirmDeleteUser.json.php or userAddNew.json.php the attacker can remove administrators, delete their videos, or demote them, compromising the integrity and availability of the platform. This flaw is categorized as CWE-863, indicating a flaw in authorization control.
Affected Systems
The affected product is WWBN AVideo, all versions prior to 29.4.0. Users running any unpatched version may be impacted. The advisory references a specific commit that resolves the issue.
Risk and Exploitability
The CVSS score of 7.0 indicates a high severity vulnerability. Although no EPSS data is available, the lack of a KEV listing suggests that active exploitation is not yet documented, but the flaw is still exploitable via standard HTTP requests to the vulnerable endpoints. The likely attack vector is over the public web interface where requests to confirmDeleteUser.json.php or userAddNew.json.php are crafted by an attacker with delegated admin rights.
