CVE-2026-40925

WWBN AVideo is an open source video platform. In versions 29.0 and prior, "objects/configurationUpdate.json.php" also routed via "/updateConfig" persists dozens of global site settings from "$POST" but protects the endpoint only with "User::isAdmin". It does not call "forbidIfIsUntrustedRequest",...