---
id: CVE-2026-114633
title: >-
  WWBN AVideo before 29.4.0 Incorrect Authorization via
  confirmDeleteUser.json.php
summary: >-
  WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability
  that allows delegated Users Admin accounts to delete or modify administrator
  accounts. Attackers can submit requests to confirmDeleteUser.json.php or
  userAddNew.…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-863
vendor: WWBN
product: AVideo
affected:
  - AVideo < 29.4.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T01:43:33.073Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114633'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-mp89-8x4j-2grx'
    label: GitHub Security Advisory (GHSA-mp89-8x4j-2grx)
  - url: >-
      https://github.com/WWBN/AVideo/commit/9c7cadaee8f472e9f6584b941af1bdaed5668145
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/wwbn-avideo-before-29.4.0-incorrect-authorization-via-confirmdeleteuser-json-php
    label: >-
      VulnCheck Advisory: WWBN AVideo before 29.4.0 Incorrect Authorization via
      confirmDeleteUser.json.php
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.194Z'
---

## Overview

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

## Affected

- `AVideo < 29.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.