CVE-2026-114633— WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WWBN AVideo 在 29.4.0 版本之前存在授权验证错误漏洞，该漏洞允许被授权的“用户管理员”账户删除或修改管理员账户。攻击者可向 confirmDeleteUser.json.php 或 userAddNew.json.php 提交针对管理员的请求，从而删除其视频和账户，或对其账号进行更改并降级。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114633
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114633
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114633
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114633 (2)
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-114634
WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTyp -
CVE-2026-114048
WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video E -
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr
Same vendor: WWBN
-
CVE-2026-114634
WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTyp -
CVE-2026-114048
WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video E -
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr
Same weakness: CWE-863
-
CVE-2026-114721
Roundcube 1.6.20/1.7.5 配置绕过漏洞 -
CVE-2026-84917
Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB -
CVE-2026-84920
Unpublished Node Permissions - Critical - Access bypass - SA -
CVE-2026-96370
Webform - Moderately critical - Access bypass, Server-side r -
CVE-2026-96373
Webform - Moderately critical - Access bypass - SA-CONTRIB-2
V. Comments for CVE-2026-114633
No comments yet