CVE-2026-40925

WWBN AVideo is an open source video platform. In versions 29.0 and prior, "objects/configurationUpdate.json.php" also routed via "/updateConfig" persists dozens of global site settings from "$POST" but protects the endpoint only with "User::isAdmin". It does not call "forbidIfIsUntrustedRequest",...

CVE-2026-40925: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not...