Authorization bypass through user-controlled key in AVideo - CVE-2026-33764
Published: May 4, 2026
Vulnerability identifier: #VU129522
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33764
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the AI plugin save.json.php endpoint when handling attacker-controlled AI response identifiers. A remote user can supply a crafted request referencing another user's AI response ID to disclose sensitive information.
Exploitation requires AI permissions and the ability to edit at least one video. Sequential AI response IDs make enumeration possible.
Affected software
AVideo
How to mitigate CVE-2026-33764
Install security update from vendor's website.
AVideo - update to 29.0