CVE-2026-40926

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — "objects/categoryAddNew.json.php", "objects/categoryDelete.json.php", and "objects/pluginRunUpdateScript.json.php" — enforce only a role check "Category::canCreateCategory" / "User::isAdmin...