Technical impact
Prior to AVideo version 29.0, the sign‑up API allows users to set elevated permissions during account creation. The set_api_signUp method accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user input without confirming that the request is authenticated with a valid APISecret. An attacker who can solve the CAPTCHA can therefore create a new account and simultaneously grant themselves email‑verified status without owning the address, and award upload, streaming, and meeting‑creation rights. This bypasses administrative controls that normally restrict such capabilities for new users, thereby enabling the attacker to acquire elevated privileges in the platform (CWE‑862). The vulnerability has been fixed in AVideo 29.0.
Affected Systems
All installations of WWBN AVideo before version 29.0 are affected. The vulnerability is present in the API plugin's set_api_signUp method for versions <29.0. No specific sub‑versions are listed beyond that, so any instance running an older release is susceptible.
Risk and Exploitability
The CVSS score of 5.3 indicates a medium severity vulnerability, and the EPSS score of less than 1% shows low current exploitation probability. Based on the description, it is inferred that the signUp endpoint is publicly reachable and only requires CAPTCHA completion, so an attacker can potentially exploit the flaw from anywhere with internet access. The flaw is not listed in the CISA KEV catalog, but the combination of unchecked permissions and public exposure warrants prompt remediation.
Github GHSA