{"items":[{"id":"NVI-00007875","kind":"vulnerability","title":"AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6547-8hrg-c55m","CVE-2026-33297"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4024ebea711e45e7126dc18e5a2419f1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.356%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.29294. Missing scores are unknown.","source_id":"sr-4024ebea711e45e7126dc18e5a2419f1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ec0b3c918a25d664eb1f1b505a12d0f0","url":"https://github.com/advisories/GHSA-6547-8hrg-c55m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6547-8hrg-c55m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.930Z"},{"id":"sr-4024ebea711e45e7126dc18e5a2419f1","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-33297","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.272Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ec0b3c918a25d664eb1f1b505a12d0f0"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control.\n\n### Details\n\nThe endpoint correctly restricts access to administrators only, but the password value submitted via the ProfilePassword request parameter is processed with `intval()` before being passed to `User::setProfilePassword()`. The relevant code is:\n\n```php\n$obj->ProfilePassword = intval(@$_REQUEST['ProfilePassword']);\n$obj->users_id = $users_id;\n$obj->response = User::setProfilePassword($users_id, $obj->ProfilePassword);\n```\n\nThe call to `intval()` on an alphanumeric string such as secretabc123 returns 0. This silently discards the intended password value and stores 0 as the channel password instead. Because the coercion is silent, the administrator receives no error or warning and has no indica","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 25.0"]}],"null_published_at":"2026-11-08T19:53:48.772Z","source_updated_at":"2026-04-07T05:16:22.250Z","source_disclosed_at":"2026-03-19T17:25:34.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:59.930Z"},{"id":"NVI-00007875","kind":"vulnerability","title":"AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6547-8hrg-c55m","CVE-2026-33297"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b4c7c2308e523cc807b95ddc23379530"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.356%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.29298. Missing scores are unknown.","source_id":"sr-b4c7c2308e523cc807b95ddc23379530"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ec0b3c918a25d664eb1f1b505a12d0f0","url":"https://github.com/advisories/GHSA-6547-8hrg-c55m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6547-8hrg-c55m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.930Z"},{"id":"sr-b4c7c2308e523cc807b95ddc23379530","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-33297","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ec0b3c918a25d664eb1f1b505a12d0f0"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control.\n\n### Details\n\nThe endpoint correctly restricts access to administrators only, but the password value submitted via the ProfilePassword request parameter is processed with `intval()` before being passed to `User::setProfilePassword()`. The relevant code is:\n\n```php\n$obj->ProfilePassword = intval(@$_REQUEST['ProfilePassword']);\n$obj->users_id = $users_id;\n$obj->response = User::setProfilePassword($users_id, $obj->ProfilePassword);\n```\n\nThe call to `intval()` on an alphanumeric string such as secretabc123 returns 0. This silently discards the intended password value and stores 0 as the channel password instead. Because the coercion is silent, the administrator receives no error or warning and has no indica","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 25.0"]}],"null_published_at":"2026-11-05T03:52:54.804Z","source_updated_at":"2026-04-07T05:16:22.250Z","source_disclosed_at":"2026-03-19T17:25:34.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:59.930Z"},{"id":"NVI-00007875","kind":"vulnerability","title":"AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6547-8hrg-c55m","CVE-2026-33297"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-ec0b3c918a25d664eb1f1b505a12d0f0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ec0b3c918a25d664eb1f1b505a12d0f0","url":"https://github.com/advisories/GHSA-6547-8hrg-c55m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6547-8hrg-c55m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.930Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ec0b3c918a25d664eb1f1b505a12d0f0"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control.\n\n### Details\n\nThe endpoint correctly restricts access to administrators only, but the password value submitted via the ProfilePassword request parameter is processed with `intval()` before being passed to `User::setProfilePassword()`. The relevant code is:\n\n```php\n$obj->ProfilePassword = intval(@$_REQUEST['ProfilePassword']);\n$obj->users_id = $users_id;\n$obj->response = User::setProfilePassword($users_id, $obj->ProfilePassword);\n```\n\nThe call to `intval()` on an alphanumeric string such as secretabc123 returns 0. This silently discards the intended password value and stores 0 as the channel password instead. Because the coercion is silent, the administrator receives no error or warning and has no indica","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 25.0"]}],"null_published_at":"2026-10-31T22:13:18.638Z","source_updated_at":"2026-04-07T05:16:22.250Z","source_disclosed_at":"2026-03-19T17:25:34.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:59.930Z"}],"next_cursor":null,"snapshot_revision":"42594"}