A flaw in the open‑source video platform allows a user with the Videos Moderator role to pursue actions beyond the documented permissions. The root cause is a mismatch in the authorization checks used for editing and deletion: the executor of an ownership transfer is incorrectly gated by a moderation check, while the deletion endpoint only verifies ownership, creating an asymmetric boundary exploitable through a two‑step transfer‑then‑delete process. This permits a moderator to steal ownership of any video and subsequently delete it, effectively bypassing the intended access controls and leading to arbitrary content loss. The weakness is identified as a role‑confusion vulnerability (CWE‑863).

This vulnerability affects all versions of WWBN AVideo up to and including 26.0. Moderators with the Videos Moderator permission are granted unintended authority over any video in the system, regardless of ownership.

The CVSS score of 7.6 classifies the flaw as high severity. The EPSS score of less than 1 % indicates that exploit activity is currently uncommon, and the vulnerability does not appear in the CISA KEV catalog. A likely attack vector requires an authenticated user with moderator privileges to exploit the missing authorization check, transfer video ownership to themselves, and then delete the video in a two‑step chain. While the exploitation probability remains low, the potential for arbitrary video deletion justifies swift action to mitigate risk.