CVE-2026-86719: Cross-Site Request Forgery (CSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...