The vulnerability is caused by the absence of CSRF token validation in the channelToGallery.json.php endpoint of AVideo. An attacker can embed a URL that triggers a GET request while an administrator’s browser is authenticated. The server processes the request without verifying the origin, allowing the attacker to modify the site‑wide gallery configuration—promoting arbitrary channels to the front page or deleting curated sections. This results in unauthorized changes to the application’s content presentation and availability.

All installations of the WWBN AVideo application that include commit 9c39d8c8 or earlier are affected. No specific product version is listed, so any AVideo deployment before the patch that removes the CSRF vulnerability is eligible for exploitation.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying limited publicly known exploit activity. Exploitation requires access to an administrator’s session cookie; once the cookie is available, the attacker can issue the crafted request. The lack of a CSRF measure makes the attack trivial for anyone who can execute an authenticated request.