AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

The impact of CVE-2026-33649 is significant due to the potential for privilege escalation. An attacker can craft a malicious webpage containing an <img> tag that, when visited by an authenticated administrator, will silently modify user group permissions. This allows the attacker to grant their own user group elevated privileges, effectively gaining near-administrator access to the system. The combination of missing CSRF protection and the session.cookie_samesite=None setting makes exploitation relatively straightforward, as the attacker can bypass same-site cookie restrictions. Successful exploitation could lead to unauthorized data access, modification, or deletion, and potentially complete system compromise.

1. Gereserveerd2026-03-23
2. Gepubliceerd2026-03-25
3. EPSS bijgewerkt2026-03-31

The primary mitigation for CVE-2026-33649 is to upgrade to a patched version of wwbn/avideo that addresses the CSRF vulnerability. If upgrading immediately is not possible, consider implementing a temporary workaround by restricting access to the plugin/Permissions/setPermission.json.php endpoint to trusted users only. Additionally, review and tighten cookie security settings, ensuring that session.cookie_samesite is set to Lax or Strict to prevent cross-site cookie access. Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint with suspicious parameters. After upgrading, confirm the fix by attempting to trigger the permission modification via a crafted URL and verifying that the request is rejected or requires authentication.

Laatste update

29.0recent