The flaw in WWBN AVideo up through version 26 permits any user with upload rights to supply an overrideStatus request parameter and set a video’s status to any valid state, including the public‑visible "active" state. This action bypasses the administrator‑controlled moderation workflow, allowing unreviewed content to go live without subjecting it to policy checks. The weakness arises because the server validates the status value against an approved list but does not confirm that the caller has permission to apply that status, a classic unauthorized privilege escalation scenario (CWE‑285).

Affected users are those who have been granted upload permissions on installations of WWBN AVideo running version 26.0 or earlier. Later releases have removed or secured the overrideStatus parameter. The vulnerability only exploits the upload functionality and does not require additional actions beyond creating or editing a video entry. Organizations that allow wide content contribution must review which accounts hold upload rights.

The CVSS base score of 4.3 places the vulnerability in the low‑moderate range of severity. The EPSS indicates a very low probability of exploitation, with a likelihood of less than 1 %. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the flaw simply by submitting an upload request containing the overrideStatus parameter, without needing further privileges or internal access to the application. The impact is limited to processing videos that bypass moderation, potentially exposing the site to policy‑violating or inappropriate content.