{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T03:10:25.326","vulnerabilities":[{"cve":{"id":"CVE-2026-34738","sourceIdentifier":"security-advisories@github.com","published":"2026-03-31T21:16:32.410","lastModified":"2026-07-24T21:10:00.143","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including \"active\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches."},{"lang":"es","value":"WWBN AVideo es una plataforma de video de código abierto. En las versiones 26.0 y anteriores, la canalización de procesamiento de video de AVideo acepta un parámetro de solicitud overrideStatus que permite a cualquier cargador establecer el estado de un video a cualquier estado válido, incluido 'activo' (a). Esto elude los flujos de trabajo de moderación y borrador controlados por el administrador. El método setStatus() valida el código de estado contra una lista de valores conocidos, pero no verifica que el llamador tenga permiso para establecer ese estado en particular. Como resultado, cualquier usuario con permisos de carga puede publicar videos directamente, eludiendo los procesos de revisión de contenido. En el momento de la publicación, no hay parches disponibles públicamente."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"WWBN","product":"AVideo","versions":[{"version":"<= 26.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-01T15:46:27.176573Z","id":"CVE-2026-34738","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*","versionEndIncluding":"26.0","matchCriteriaId":"774C24F1-9D26-484F-B931-1DA107C8F588"}]}]}],"references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}