CVE-2026-40926

The record

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce only a role check (`Category::canCreateCategory()` / `User::isAdmin()`) and perform state-changing actions against the database without calling `isGlobalTokenValid()` or `forbidIfIsUntrustedRequest()`. Peer endpoints in the same directory (`pluginSwitch.json.php`, `pluginRunDatabaseScript.json.php`) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's `updateScript()` method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.

Affected packages

Related vulnerabilities

• GHSA-ffw8-fwxp-h64w WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD… Same vulnerability
• CVE-2026-96388 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application… CWE-352
• CVE-2026-96374 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross… CWE-352
• CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation… CWE-352
• CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow… CWE-352
• CVE-2026-111883 Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows… CWE-352
• CVE-2026-62139 Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0… CWE-352
• CVE-2026-62133 Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. CWE-352