What is CVE-2026-114633?

CVE-2026-114633 is a medium-severity vulnerability in Wwbn Avideo, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2026-10-22.

How severe is CVE-2026-114633?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Wwbn Avideo

CVE-2026-114633

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

Vulnerability class: Broken Access Control

Published 2026-10-22 · last modified 2026-10-22.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Wwbn Avideo

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

github.com/WWBN/AVideo/security/advisories/GHSA-mp89-8x4j-2grx (vendor-advisory)
github.com/WWBN/AVideo/commit/9c7cadaee8f472e9f6584b941af1bdaed5668145 (patch)
www.vulncheck.com/advisories/wwbn-avideo-before-29.4.0-incorrect-authorization-… (third-party-advisory)

Frequently asked questions

What is CVE-2026-114633?: CVE-2026-114633 is a medium-severity vulnerability in Wwbn Avideo, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2026-10-22.
How severe is CVE-2026-114633?: Medium severity. CVSS v3 base score is 6.5 out of 10.