The vulnerability in AVideo’s setPermission.json.php endpoint allows an attacker to perform a cross‑site request forgery (CSRF) without any authentication token. By sending GET requests that manipulate user group permissions, an attacker can grant themselves elevated privileges, potentially reaching near‑administrative access. The flaw is a classic state‑changing CSRF weakness (CWE‑352) and is highlighted by the lack of CSRF token validation and the application’s use of session.cookie_samesite=None, which permits cookies to be sent in cross‑origin requests.

Affects the open‑source video platform AVideo from WWBN, in all releases up to and including 26.0. No patched version is available at the time of disclosure, so the vulnerability remains present in the current codebases used by administrators.

The CVSS base score of 8.1 reflects a significant risk, and the EPSS score of less than 1% indicates that widespread exploitation is unlikely at present, but the flaw is still severe. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the exploit simply by hosting a webpage that includes an <img> tag pointing to the vulnerable endpoint; any admin who visits that page would unknowingly execute the privileged action. Because the request is made via GET, no user interaction beyond visiting the page is required.