CVE-2026-92582— AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AVideo（WWBN/AVideo）在 29.0 版本（提交 e01e41ecc）及之前版本中存在跨站请求伪造（CSRF）漏洞。 在文件 中，AVideo 的自动 CSRF 防护机制（ ）和不可信请求检查（ ）仅因为请求中存在 和 参数而被跳过。然而，这些参数的值从未经过验证，且直接从 中读取，因此攻击者可以在跨站请求的查询字符串中提供这些参数。 由于 方法在检测到已存在会话时会立即返回，因此通过 Cookie 已认证的受害者用户会自动满足该检查，而攻击者提供的凭证则被忽略。 因此，如果攻击者诱导拥有上传权限的已
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92582
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely because 'user' and 'pass' parameters are present in the request; the values are never validated and are read from $_REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records — including ownership transfer (setUsers_id), deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92582
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92582
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92582 (2)
Same Patch Batch · WWBN · 2026-09-16 · 10 CVEs total
| CVE-2026-92580 | 8.8 HIGH | AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF |
| CVE-2026-92578 | 8.1 HIGH | WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash |
| CVE-2026-92577 | 7.5 HIGH | AVideo through 29.0 API get_api_video Broken Access Control via clean_title |
| CVE-2026-92583 | 6.5 MEDIUM | AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment |
| CVE-2026-92584 | 6.1 MEDIUM | AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header |
| CVE-2026-92579 | 5.4 MEDIUM | AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision |
| CVE-2026-92585 | 4.3 MEDIUM | AVideo through 29.0 Missing Authorization Check via API Like Endpoint |
| CVE-2026-92581 | 4.3 MEDIUM | AVideo through 29.0 Like Counter Desynchronization via Array Parameter |
| CVE-2026-92586 | 4.3 MEDIUM | AVideo through 29.0 Missing Authorization via comment API endpoint |
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-92586
AVideo through 29.0 Missing Authorization via comment API en -
CVE-2026-92584
AVideo through 29.0 Stored Cross-Site Scripting via User-Age -
CVE-2026-92585
AVideo through 29.0 Missing Authorization Check via API Like -
CVE-2026-92583
AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter -
CVE-2026-92581
AVideo through 29.0 Like Counter Desynchronization via Array
Same vendor: WWBN
-
CVE-2026-92586
AVideo through 29.0 Missing Authorization via comment API en -
CVE-2026-92585
AVideo through 29.0 Missing Authorization Check via API Like -
CVE-2026-92584
AVideo through 29.0 Stored Cross-Site Scripting via User-Age -
CVE-2026-92583
AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter -
CVE-2026-92581
AVideo through 29.0 Like Counter Desynchronization via Array
Same weakness: CWE-352
-
CVE-2026-92806
phpList before 3.6.17 Cross-Site Request Forgery via massrem -
CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing -
CVE-2026-61593
djust has Cross-Site Request Forgery on the Server-Sent-Even -
CVE-2026-92383
PbootCMS User Management UserController.php mod cross-site r -
CVE-2026-19535
Advantech EKI-1242IEIMS V1.06.01 CSRF漏洞
V. Comments for CVE-2026-92582
No comments yet