CVE-2026-40926

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check (Category::canCreateCategory() / User::isAdmin()) and perform state-changing actions against the database without calling isGlobalTokenValid() or forbidIfIsUntrustedRequest(). Peer endpoints in the same directory (pluginSwitch.json.php, pluginRunDatabaseScript.json.php) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's updateScript() method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check (Category::canCreateCategory() / User::isAdmin()) and perform state-changing actions against the database without calling isGlobalTokenValid() or forbidIfIsUntrustedRequest(). Peer endpoints in the same directory (pluginSwitch.json.php, pluginRunDatabaseScript.json.php) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's updateScript() method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.

Summary

Three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check (Category::canCreateCategory() / User::isAdmin()) and perform state-changing actions against the database without calling isGlobalTokenValid() or forbidIfIsUntrustedRequest(). Peer endpoints in the same directory (pluginSwitch.json.php, pluginRunDatabaseScript.json.php) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's updateScript() method in the admin's session.

Details

AVideo's CSRF defense is not applied globally — each endpoint must explicitly call isGlobalTokenValid() (defined in objects/functions.php:2313), which verifies $_REQUEST['globalToken']. A search across the codebase shows 18 files that correctly invoke forbidIfIsUntrustedRequest() or isGlobalTokenValid(), while the three endpoints below do not.

1. objects/categoryAddNew.json.php:18 — CSRF create/overwrite category

 18 if (!Category::canCreateCategory()) {
 19     $obj->msg = __("Permission denied");
 20     die(json_encode($obj));
 21 }
 22
 23 $objCat = new Category(intval(@$_POST['id']));
 24 $objCat->setName($_POST['name']);
 25 $objCat->setClean_name($_POST['clean_name']);
 26 $objCat->setDescription($_POST['description']);
 27 $objCat->setIconClass($_POST['iconClass']);
 28 $objCat->setSuggested($_POST['suggested']);
 29 $objCat->setParentId($_POST['parentId']);
 30 $objCat->setPrivate($_POST['private']);
 31 $objCat->setAllow_download($_POST['allow_download']);
 32 $objCat->setOrder($_POST['order']);
 33 $obj->categories_id = $objCat->save();

Category::canCreateCategory() (objects/category.php:620-630) returns true for any admin. Because the row is loaded via new Category(intval(@$_POST['id'])), a non-zero id causes the existing row to be overwritten, not just created — the same primitive can mutate existing categories. No CSRF/Origin check precedes the write.

2. objects/categoryDelete.json.php:10 — CSRF delete category

 10 if (!Category::canCreateCategory()) {
 11     die('{"error":"' . __("Permission denied") . '"}');
 12 }
 13 require_once 'category.php';
 14 $obj = new Category($_POST['id']);
 15 $response = $obj->delete();

No token check. An attacker can force an admin browser to POST any id, deleting rows from categories.

3. objects/pluginRunUpdateScript.json.php:9 — CSRF forced plugin update

  9 if (!User::isAdmin()) {
 10     forbiddenPage('Permission denied');
 11 }
 12 if (empty($_POST['name'])) {
 13     forbiddenPage('Name can\'t be blank');
 14 }
 15 ini_set('max_execution_time', 300);
 16 require_once $global['systemRootPath'] . 'plugin/AVideoPlugin.php';
 17
 18 if($_POST['uuid'] == 'plist12345-370-4b1f-977a-fd0e5cabtube'){
 19     $_POST['name'] = 'PlayLists';
 20 }
 21
 22 $obj = new stdClass();
 23 $obj->error = !AVideoPlugin::updatePlugin($_POST['name']);

AVideoPlugin::updatePlugin() (plugin/AVideoPlugin.php:1452) looks up the plugin by name and, if it defines an updateScript() method, invokes it and then records the new plugin version via Plugin::setCurrentVersionByUuid. No CSRF or Origin check precedes this. By contrast, the sibling endpoint objects/pluginRunDatabaseScript.json.php:16 does call isGlobalTokenValid(), and objects/pluginSwitch.json.php:12 also calls it — confirming this file is an omission.

Why no global mitigation blocks this

• isGlobalTokenValid() is not invoked from objects/configuration.php or any other bootstrap; it must be called per-endpoint.
• isUntrustedRequest() (objects/functionsSecurity.php:146) is only triggered via an explicit call to forbidIfIsUntrustedRequest(); none of the three…

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check (Category::canCreateCategory() / User::isAdmin()) and perform state-changing actions against the database without calling isGlobalTokenValid() or forbidIfIsUntrustedRequest(). Peer endpoints in the same directory (pluginSwitch.json.php, pluginRunDatabaseScript.json.php) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's updateScript() method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check (Category::canCreateCategory() / User::isAdmin()) and perform state-changing actions against the database without calling isGlobalTokenValid() or forbidIfIsUntrustedRequest(). Peer endpoints in the same directory (pluginSwitch.json.php, pluginRunDatabaseScript.json.php) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's updateScript() method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.

Summary

Three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check (Category::canCreateCategory() / User::isAdmin()) and perform state-changing actions against the database without calling isGlobalTokenValid() or forbidIfIsUntrustedRequest(). Peer endpoints in the same directory (pluginSwitch.json.php, pluginRunDatabaseScript.json.php) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's updateScript() method in the admin's session.

Details

AVideo's CSRF defense is not applied globally — each endpoint must explicitly call isGlobalTokenValid() (defined in objects/functions.php:2313), which verifies $_REQUEST['globalToken']. A search across the codebase shows 18 files that correctly invoke forbidIfIsUntrustedRequest() or isGlobalTokenValid(), while the three endpoints below do not.

1. objects/categoryAddNew.json.php:18 — CSRF create/overwrite category

 18 if (!Category::canCreateCategory()) {
 19     $obj->msg = __("Permission denied");
 20     die(json_encode($obj));
 21 }
 22
 23 $objCat = new Category(intval(@$_POST['id']));
 24 $objCat->setName($_POST['name']);
 25 $objCat->setClean_name($_POST['clean_name']);
 26 $objCat->setDescription($_POST['description']);
 27 $objCat->setIconClass($_POST['iconClass']);
 28 $objCat->setSuggested($_POST['suggested']);
 29 $objCat->setParentId($_POST['parentId']);
 30 $objCat->setPrivate($_POST['private']);
 31 $objCat->setAllow_download($_POST['allow_download']);
 32 $objCat->setOrder($_POST['order']);
 33 $obj->categories_id = $objCat->save();

Category::canCreateCategory() (objects/category.php:620-630) returns true for any admin. Because the row is loaded via new Category(intval(@$_POST['id'])), a non-zero id causes the existing row to be overwritten, not just created — the same primitive can mutate existing categories. No CSRF/Origin check precedes the write.

2. objects/categoryDelete.json.php:10 — CSRF delete category

 10 if (!Category::canCreateCategory()) {
 11     die('{"error":"' . __("Permission denied") . '"}');
 12 }
 13 require_once 'category.php';
 14 $obj = new Category($_POST['id']);
 15 $response = $obj->delete();

No token check. An attacker can force an admin browser to POST any id, deleting rows from categories.

3. objects/pluginRunUpdateScript.json.php:9 — CSRF forced plugin update

  9 if (!User::isAdmin()) {
 10     forbiddenPage('Permission denied');
 11 }
 12 if (empty($_POST['name'])) {
 13     forbiddenPage('Name can\'t be blank');
 14 }
 15 ini_set('max_execution_time', 300);
 16 require_once $global['systemRootPath'] . 'plugin/AVideoPlugin.php';
 17
 18 if($_POST['uuid'] == 'plist12345-370-4b1f-977a-fd0e5cabtube'){
 19     $_POST['name'] = 'PlayLists';
 20 }
 21
 22 $obj = new stdClass();
 23 $obj->error = !AVideoPlugin::updatePlugin($_POST['name']);

AVideoPlugin::updatePlugin() (plugin/AVideoPlugin.php:1452) looks up the plugin by name and, if it defines an updateScript() method, invokes it and then records the new plugin version via Plugin::setCurrentVersionByUuid. No CSRF or Origin check precedes this. By contrast, the sibling endpoint objects/pluginRunDatabaseScript.json.php:16 does call isGlobalTokenValid(), and objects/pluginSwitch.json.php:12 also calls it — confirming this file is an omission.

Why no global mitigation blocks this

• isGlobalTokenValid() is not invoked from objects/configuration.php or any other bootstrap; it must be called per-endpoint.
• isUntrustedRequest() (objects/functionsSecurity.php:146) is only triggered via an explicit call to forbidIfIsUntrustedRequest(); none of the three…