SecuriTricks - CVE-2026-43883

Description

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim. Commit 0da3dcff1eda2f497694bf82b559829471c292c2 contains an updated fix.

Product(s) Impacted

Vendor	Product	Versions
Wwbn	Avideo	29.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	wwbn	avideo	29.0	/	/	/	/	/	/	/

References

https://github.com/WWBN/AVideo/commit/0da3dcff1eda2f497694bf82b559829471c292c2

https://github.com/WWBN/AVideo/security/advisories/GHSA-958h-qp3x-q4gj

CVSS Score

4.2 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

View Vector String

Timeline

Published: May 11, 2026, 10:22 p.m.
Last Modified: May 12, 2026, 6:17 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-43883