CVE-2026-114633

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114633
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114633.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114633
Aliases
  • GHSA-mp89-8x4j-2grx
Published
2026-10-22T01:43:33Z
Modified
2026-10-22T10:45:51Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
Details

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114633.json"
}
References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type
GIT
Repo
https://github.com/wwbn/avideo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a76721723acd72dae306cc58c4931e1193b90f8d
Fixed
9c7cadaee8f472e9f6584b941af1bdaed5668145
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "29.4.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "9c7cadaee8f472e9f6584b941af1bdaed5668145"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

10.*
10.8
Other
11
11.*
11.1
11.1.1
11.5
11.6
12.*
12.4
14.*
14.3
14.3.1
18.*
18.0
2.*
2.2
2.7
21.*
21.0
22.*
22.0
24.*
24.0
25.*
25.0
26.*
26.0
29.*
29.0
3.*
3.4
4.*
4.0
7.*
7.2
7.3
7.4
7.6
7.7
7.8
8.*
8.1
8.5
8.6
8.7
8.9
8.9.1
v29.*
v29.1.0
v29.1.1
v29.2.0
v29.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114633.json"