CVE-2026-114633 WWBN CVE debrief

Who should care

Defenders managing AVideo instances, especially those with delegated administration or User Admin accounts, should assess exposure and potential impact of the incorrect authorization vulnerability. They should verify instance exposure, assess potential impact on User Admin accounts, and update AVideo to version 29.4.0 or later. Additionally, defenders should monitor for suspicious activity targeting administrator accounts and review compensating controls.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact of the incorrect authorization vulnerability in WWBN AVideo before 29.4.0, focusing on User Admin accounts and instances with delegated administration.

• Potential unauthorized deletion or modification of administrator accounts
• Possible disruption of administrative functions
• Risk of privilege escalation through delegated administration
• Need for verification of instance exposure and version assessment

Technical summary

The CVE record and source item describe an incorrect authorization vulnerability in WWBN AVideo before 29.4.0, allowing delegated Users Admin accounts to delete or modify administrator accounts through requests to confirmDeleteUser.json.php or userAddNew.json.php. This vulnerability could lead to unauthorized deletion or modification of administrator accounts, disruption of administrative functions, and potential privilege escalation through delegated administration. Defenders should prioritize verifying exposure and assessing potential impact, focusing on User Admin accounts and instances with delegated administration. The vulnerability is highly severe with a CVSS score of 7.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on User Admin accounts and instances with delegated administration.

Recommended defensive actions

• Verify AVideo instances for exposure, focusing on versions before 29.4.0
• Assess potential impact on User Admin accounts with delegated administration
• Update AVideo to version 29.4.0 or later
• Monitor for suspicious activity targeting administrator accounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the incorrect authorization vulnerability in WWBN AVideo before 29.4.0, allowing delegated Users Admin accounts to delete or modify administrator accounts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.