CVE-2026-40928

{"id": "CVE-2026-40928", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40928", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T13:15:40.914548Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 29.0"}]}]}], "published": "2026-04-21T23:16:20.300", "references": [{"url": "https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (`objects/comments_like.json.php`), post a comment authored by the victim on any video, with attacker-chosen text (`objects/commentAddNew.json.php`), and/or delete assets from any category (`objects/categoryDeleteAssets.json.php`) when the victim has category management rights. Each endpoint is reachable from a browser via a simple `<img src=\"\u2026\">` tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 29.0 y anteriores, m\u00faltiples endpoints JSON de AVideo bajo \u201cobjects/\u201d aceptan solicitudes que cambian el estado a trav\u00e9s de \u201c$_REQUEST\u201d/\u201c$_GET\u201d y persisten los cambios vinculados al usuario de la sesi\u00f3n del llamante, sin ning\u00fan token anti-CSRF, verificaci\u00f3n de origen o verificaci\u00f3n de referer. Una p\u00e1gina maliciosa visitada por una v\u00edctima que ha iniciado sesi\u00f3n puede silenciosamente emitir/cambiar el \u2019me gusta\u2019/\u2019no me gusta\u2019 de la v\u00edctima en cualquier comentario (\u201cobjects/comments_like.json.php\u201d), publicar un comentario escrito por la v\u00edctima en cualquier video, con texto elegido por el atacante (\u201cobjects/commentAddNew.json.php\u201d), y/o eliminar activos de cualquier categor\u00eda (\u201cobjects/categoryDeleteAssets.json.php\u201d) cuando la v\u00edctima tiene derechos de gesti\u00f3n de categor\u00edas. Cada endpoint es accesible desde un navegador a trav\u00e9s de una simple etiqueta \u201c<img src=\u201c...\u201d>\u201d o env\u00edo de formulario, por lo que la explotaci\u00f3n solo requiere que la v\u00edctima cargue un recurso HTML controlado por el atacante. El commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contiene una correcci\u00f3n."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA", "versionEndIncluding": "29.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}