Packagist/wwbn/avideo CVE-2026-33649: high 8.1, EPSS 0.23%

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-g8x9-7mgh-7cvj
• https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj
• https://nvd.nist.gov/vuln/detail/CVE-2026-33649
• https://github.com/WWBN/AVideo

CVE-2026-33649 · published 2026-03-25T17:48:17Z · modified 2026-03-25T18:11:20.170676Z · JSON